Trojan.Agent

[srader]

I have acquired this somehow. I have attached the two logs below. I have tried everything I know, and I am at the end of my rope. Any help is greatly appreciated.

dds.txt

dds.txt

[MrCharlie]

Welcome to the forum.

Please remove any usb or external drives from the computer before you run this scan!

Please download and run RogueKiller to your desktop.

Quit all running programs.

For Windows XP, double-click to start.

For Vista or Windows 7, do a right-click on the program, select Run as Administrator to start, & when prompted Allow to run.

Click Scan to scan the system.

When the scan completes > Close out the program > Don't Fix anything!

Don't run any other options, they're not all bad!!!!!!!

Post back the report which should be located on your desktop.

MrC

------->Your topic will be closed if you haven't replied within 3 days!<--------

(If I don't respond within 48 hours, please send me a PM)

[srader]

Thank you for responding. I clicked on follow this topic and I am not receiving notification via email. Here you go:

RogueKiller V8.3.1 [Nov 20 2012] by Tigzy

mail: tigzyRK<at>gmail<dot>com

Feedback: http://www.geekstogo.com/forum/files/file/413-roguekiller/

Website: http://tigzy.geekstogo.com/roguekiller.php

Blog: http://tigzyrk.blogspot.com

Operating System: Windows 7 (6.1.7601 Service Pack 1) 64 bits version

Started in : Normal mode

User : Scott Rader [Admin rights]

Mode : Scan -- Date : 11/21/2012 17:57:09

¤¤¤ Bad processes : 2 ¤¤¤

[sUSP PATH] agent.exe -- C:\ProgramData\FLEXnet\Connect\11\agent.exe -> KILLED [TermProc]

[sUSP PATH] ISUSPM.exe -- C:\ProgramData\FLEXnet\Connect\11\ISUSPM.exe -> KILLED [TermProc]

¤¤¤ Registry Entries : 14 ¤¤¤

[RUN][sUSP PATH] HKCU\[...]\Run : ISUSPM (C:\ProgramData\FLEXnet\Connect\11\ISUSPM.exe -scheduler) -> FOUND

[RUN][sUSP PATH] HKUS\S-1-5-21-3329683265-849701328-4092323621-1000[...]\Run : ISUSPM (C:\ProgramData\FLEXnet\Connect\11\ISUSPM.exe -scheduler) -> FOUND

[RUN][ROGUE ST] HKLM\[...]\Policies\Explorer\\Run : 28776 (C:\PROGRA~3\LOCALS~1\Temp\mswiai.exe) -> FOUND

[RUN][ROGUE ST] HKLM\[...]\Wow6432Node\Policies\Explorer\\Run : 28776 (C:\PROGRA~3\LOCALS~1\Temp\mswiai.exe) -> FOUND

[sTARTUP][sUSP PATH] Best Buy pc app.lnk @Default : C:\ProgramData\Best Buy pc app\ClickOnceSetup.exe -> FOUND

[sTARTUP][sUSP PATH] Best Buy pc app.lnk @Default User : C:\ProgramData\Best Buy pc app\ClickOnceSetup.exe -> FOUND

[HJPOL] HKLM\[...]\System : DisableRegistryTools (0) -> FOUND

[HJ] HKLM\[...]\System : ConsentPromptBehaviorAdmin (0) -> FOUND

[HJPOL] HKLM\[...]\Wow6432Node\System : DisableRegistryTools (0) -> FOUND

[HJ] HKLM\[...]\Wow6432Node\System : ConsentPromptBehaviorAdmin (0) -> FOUND

[HJ] HKLM\[...]\System : EnableLUA (0) -> FOUND

[HJ] HKLM\[...]\Wow6432Node\System : EnableLUA (0) -> FOUND

[HJ DESK] HKLM\[...]\NewStartPanel : {59031a47-3f72-44a7-89c5-5595fe6b30ee} (1) -> FOUND

[HJ DESK] HKLM\[...]\NewStartPanel : {20D04FE0-3AEA-1069-A2D8-08002B30309D} (1) -> FOUND

¤¤¤ Particular Files / Folders: ¤¤¤

¤¤¤ Driver : [NOT LOADED] ¤¤¤

¤¤¤ HOSTS File: ¤¤¤

--> C:\windows\system32\drivers\etc\hosts

ÿþ1

¤¤¤ MBR Check: ¤¤¤

+++++ PhysicalDrive0: Hitachi HTS545050B9A300 +++++

--- User ---

[MBR] 3e9a016685c6618b6849560ab575eb30

[bSP] 63885d87e66f1c5e0588240d5acca9d1 : Windows Vista MBR Code

Partition table:

0 - [ACTIVE] ACER (0x27) [VISIBLE] Offset (sectors): 2048 | Size: 1500 Mo

1 - [XXXXXX] NTFS (0x07) [VISIBLE] Offset (sectors): 3074048 | Size: 461381 Mo

2 - [XXXXXX] NTFS (0x17) [HIDDEN!] Offset (sectors): 947982336 | Size: 14058 Mo

User = LL1 ... OK!

User = LL2 ... OK!

Finished : << RKreport[1]_S_11212012_02d1757.txt >>

RKreport[1]_S_11212012_02d1757.txt

[MrCharlie]

Please create a new system restore point before running Malwarebytes Anti-Rootkit.

MBAR tutorial

MBAR tutorial

Download Malwarebytes Anti-Rootkit from HERE

• Unzip the contents to a folder in a convenient location.
  
• Open the folder where the contents were unzipped and run mbar.exe
  
• Follow the instructions in the wizard to update and allow the program to scan your computer for threats.
  
• Click on the Cleanup button to remove any threats and reboot if prompted to do so.
  
• Wait while the system shuts down and the cleanup process is performed.
  
• Perform another scan with Malwarebytes Anti-Rootkit to verify that no threats remain. If they do, then click Cleanup once more and repeat the process.
  
• When done, please post the two logs produced they will be in the MBAR folder..... mbar-log.txt and system-log.txt
  

To attach a log if needed:

Bottom right corner of this page.

New window that comes up.

MrC

[srader]

I ran it a couple of times, but the threat is always there after I reboot and run the anti-root kit tool. The logs are attached.

mbar-log-2012-11-21 (20-26-58).txt

system-log.txt

[MrCharlie]

Please download and run ComboFix.

The most important things to remember when running it is to disable all your malware programs and run Combofix from your desktop.

Please visit this webpage for download links, and instructions for running ComboFix

http://www.bleepingcomputer.com/combofix/how-to-use-combofix

Ensure you have disabled all anti virus and anti malware programs so they do not interfere with the running of ComboFix.

Information on disabling your malware programs can be found Here.

Make sure you run ComboFix from your desktop.

Give it at least 30-45 minutes to finish if needed.

Please include the C:\ComboFix.txt in your next reply for further review.

---------->NOTE<----------

If you get the message Illegal operation attempted on registry key that has been marked for deletion after you run ComboFix....please reboot the computer, this should resolve the problem. You may have to do this several times if needed.

MrC

[srader]

Here you go. Again, thanks for your continued effort.

ComboFix.txt

[MrCharlie]

Run RogueKiller again and click Scan

When the scan completes > click on the Registry tab

Put a check next to all of these and uncheck the rest: (if found)

[RUN][ROGUE ST] HKLM\[...]\Policies\Explorer\\Run : 28776 (C:\PROGRA~3\LOCALS~1\Temp\mswiai.exe) -> FOUND

[RUN][ROGUE ST] HKLM\[...]\Wow6432Node\Policies\Explorer\\Run : 28776 (C:\PROGRA~3\LOCALS~1\Temp\mswiai.exe) -> FOUND

[HJPOL] HKLM\[...]\System : DisableRegistryTools (0) -> FOUND

[HJ] HKLM\[...]\System : ConsentPromptBehaviorAdmin (0) -> FOUND

[HJPOL] HKLM\[...]\Wow6432Node\System : DisableRegistryTools (0) -> FOUND

[HJ] HKLM\[...]\Wow6432Node\System : ConsentPromptBehaviorAdmin (0) -> FOUND

[HJ] HKLM\[...]\System : EnableLUA (0) -> FOUND

[HJ] HKLM\[...]\Wow6432Node\System : EnableLUA (0) -> FOUND

Now click Delete on the right hand column under Options

~~~~~~~~~~~~~~~~~~~~~~~~

Download TFC to your desktop

Close any open windows.

Double click the TFC icon to run the program

TFC will close all open programs itself in order to run,

Click the Start button to begin the process.

Allow TFC to run uninterrupted.

The program should not take long to finish it's job

Once its finished it should automatically reboot your machine,

if it doesn't, manually reboot to ensure a complete clean

~~~~~~~~~~~~~~~~~~~~~~~~

Then.......

Please Update and run a Quick Scan with Malwarebytes Anti-Malware, post the report.

Make sure that everything is checked, and click Remove Selected.

Please let me know how computer is running now, MrC

[srader]

None of those registry items were listed in RogueKiller. I'm running the Malwarebytes scan now. Unfortunately, I will not be able to post anymore until later this evening. Thanks again for your ongoing help.

[MrCharlie]

OK, no problem.....MrC

[srader]

The scan still detected it. I did the reboot and am running another scan right now. I went ahead and attached the Malwarebytes log.

mbam-log-2012-11-22 (10-54-56).txt

[srader]

Still, there after the second scan.

[MrCharlie]

That's just a registry entry, are you familiar with the registry?

If so > Go to Start > Run > type REGEDIT > Enter

navigate to this key:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\Run

See if this value exists:

"28776"

If so > right click on 28776 and choose "delete"

Then wait 10 seconds and press F5 on your keyboard to refresh Regedit. See if it comes back

~~~~~~~~~~~~~~~~~~~~~~~~~

If you're not familiar with the registry:

Download and unzip the attached fixit.zip to your desktop

reboot into safe mode > double click on fixit.reg and allow it to merge into the registry.

Reboot into normal mode.

Let me know

[srader]

I actually tried to manually delete it from the registry before posting on the forum. I tried again and when I right-click on it and click on delete I get a message saying, "Unable to delete all specified values."

[MrCharlie]

Right click on the key and sub key and check the permissions.

Let me know...MrC

[srader]

It says everyone, but down below in the box that says Special Permissions on the line that says Allow Everyone is checked and it is grayed out.

[MrCharlie]

Please download on the Desktop the following application: Windows Repair

Next, extract and launch the Repair_Windows.exe

Click on Start repairs tab and then click on Start

Check mark following options alone

Reset Registry Permissions

Reset File Permissions

Repair WMI

Remove Policies Set By Infections

Checkmark Restart System When Finished option

click the Start button

System should restart after repair

Let me know.....MrC

[srader]

I did the initial scan and it found it. Rebooted it scanned again, and it was gone. Thank you!

[MrCharlie]

So what worked??

The Windows Repair and then you were able to delete it?

We still have some cleanup to do. MrC

[srader]

I did the Windows Repair. When it restarted I ran Malware Bytes. It detected, then I did a reboot and ran it again and it did not detect it. I went into the registry afterwords and it was deleted from there.

[MrCharlie]

OK, lets check for any adware on the system.............

Please download AdwCleaner from here and save it on your Desktop.

1. Right-click on adwcleaner.exe and select Run As Administrator (for XP just double click) to launch the application.
   
2. Now click on the Search tab.
   
3. Please post the contents of the log-file created in your next post.
   

Note: The log can also be located at C:\ >> AdwCleaner[XX].txt >> XX <-- Denotes the number of times the application has been ran, so in this should be something like R1.

MrC

[srader]

When I started to run that I got the message that is on the attachment.

Doc1.doc

[MrCharlie]

I can't read that, you'll have to post it.

Please reboot into safe mode and try to run it..

MrC

[srader]

Here you go.

AdwCleanerR1.txt

[MrCharlie]

Some adware found....lets clear it out.....

1. Please re-run AdwCleaner
   
2. Click on Delete button.
   
3. Confirm each time with OK if asked.
   
4. Your computer will be rebooted automatically. A text file will open after the restart. Please post the content of that logfile in your reply.
   

Note: You can find the logfile at C:\AdwCleaner[sn].txt as well - n is the order number.

~~~~~~~~~~~~~~~~~~~~

Then................

Lets check your computers security before you go and we have a little cleanup to do also:

Download Security Check by screen317 from HERE or HERE.

• Save it to your Desktop.
  
• Double click SecurityCheck.exe and follow the onscreen instructions inside of the black box.
  
• A Notepad document should open automatically called checkup.txt.
  
• Please Post the contents of that document.
  
• Do Not Attach It!!!
  

MrC