Chris1 Posted December 27, 2012 ID:627267 Share Posted December 27, 2012 Hi there,For starters, I would like to tell you people how great you are for what you do. This program has already helped me a number of times and the fact you have this forum to help people is unbeleivable. Thank you so much in advance.So I got this virus/infection called "ukash" or something. It originally locked up my computer but I started in safe mode and was able to do a quick scan whick caught 4 items which I removed. Rebooted my laptop and everything seemed normal and fine. As a precaution, I did another quick scan as always and it found 2 items again. I removed and and rebooted and this keeps repeating itself. Laptop and everything seems to be running fine. I also did a system restore about two weeks prior to getting the virus.I don't know what to do. Any help would be greatly appreciated. Please keep in mind I'm not computer savy at all so giving me advice might take a bit long. For example, I've seen on some of the other threads people posting there results and stuff from scans. I dont know how to do that. Copy and paste?? Link to post Share on other sites More sharing options...
MrCharlie Posted December 27, 2012 ID:627278 Share Posted December 27, 2012 Yes...copy and paste or >>>To attach a log if needed:Bottom right corner of this page.New window that comes up.Welcome to the forum, please start at the link below:http://forums.malwar...?showtopic=9573Post back the 2 logs here.....DDS.txt and Attach.txt<====><====><====><====><====><====><====><====>Next.......Please remove any usb or external drives from the computer before you run this scan!Quit all running programs.Please download and run RogueKiller to your desktop.For Windows XP, double-click to start.For Vista or Windows 7, do a right-click on the program, select Run as Administrator to start, & when prompted Allow to run.Click Scan to scan the system. When the scan completes > Close out the program > Don't Fix anything!Don't run any other options, they're not all bad!!!!!!!Post back the report which should be located on your desktop.MrC------->Your topic will be closed if you haven't replied within 3 days!<--------(If I don't respond within 48 hours, please send me a PM) Link to post Share on other sites More sharing options...
Chris1 Posted December 27, 2012 Author ID:627291 Share Posted December 27, 2012 Hi, hope I did this right.attach.txtdds.txt Link to post Share on other sites More sharing options...
Chris1 Posted December 27, 2012 Author ID:627293 Share Posted December 27, 2012 here is the roguekiller reportRKreport1_S_12272012_02d1059.txt Link to post Share on other sites More sharing options...
Chris1 Posted December 27, 2012 Author ID:627301 Share Posted December 27, 2012 Quit all running programs.I accidently think I had skype running in the background. Is that a problem? Do I need to do again? Link to post Share on other sites More sharing options...
MrCharlie Posted December 27, 2012 ID:627318 Share Posted December 27, 2012 That's OK...you did it right.Run RogueKiller again and click ScanWhen the scan completes > click on the Registry tabPut a check next to all of these and uncheck the rest: (if found)[sHELL][sUSP PATH] HKCU\[...]\Windows : Load (C:\Users\Chris\LOCALS~1\Temp\msbuoou.com) -> FOUND[sHELL][sUSP PATH] HKUS\S-1-5-21-2139899955-2000761512-3388395803-1000[...]\Windows : Load (C:\Users\Chris\LOCALS~1\Temp\msbuoou.com) -> FOUND[sTARTUP][bLACKLISTDLL] ms006FC3CD.dat.lnk @Chris : C:\Windows\System32\rundll32.exe|C:\PROGRA~3\ms006FC3CD.dat,H9922 -> FOUNDNow click Delete on the right hand column under Options~~~~~~~~~~~~~~~~~~~~~~~Please create a new system restore point before running Malwarebytes Anti-Rootkit if you can.MBAR tutorialDownload Malwarebytes Anti-Rootkit from HEREUnzip the contents to a folder in a convenient location.Open the folder where the contents were unzipped and run mbar.exeFollow the instructions in the wizard to update and allow the program to scan your computer for threats.Click on the Cleanup button to remove any threats and reboot if prompted to do so.Wait while the system shuts down and the cleanup process is performed.Perform another scan with Malwarebytes Anti-Rootkit to verify that no threats remain. If they do, then click Cleanup once more and repeat the process.When done, please post the two logs produced they will be in the MBAR folder..... mbar-log.txt and system-log.txtTo attach a log if needed:Bottom right corner of this page.New window that comes up.~~~~~~~~~~~~~~~~~~~~~~~Note:If no additional threats were found, verify that your system is now running normally, making sure that the following items are functional:Internet accessWindows UpdateWindows FirewallIf there are additional problems with your system, such as any of those listed above or other system issues, then run the fixdamage tool included with Malwarebytes Anti-Rootkit and reboot.Verify that your system is now functioning normally.MrC Link to post Share on other sites More sharing options...
Chris1 Posted December 27, 2012 Author ID:627329 Share Posted December 27, 2012 and uncheck the rest: (if found)Im such a moron, I think I forgot to uncheck the rest Link to post Share on other sites More sharing options...
MrCharlie Posted December 27, 2012 ID:627333 Share Posted December 27, 2012 Not a problem...just run MBAR as instructed, MrC Link to post Share on other sites More sharing options...
Chris1 Posted December 27, 2012 Author ID:627409 Share Posted December 27, 2012 I don't have anything that says mbar.exeAll I have are these:p.sWhen this is all done can I delete all this stuff?mbar-1.01.0.1011.zip Link to post Share on other sites More sharing options...
MrCharlie Posted December 27, 2012 ID:627411 Share Posted December 27, 2012 MBAR = Malwarebytes Anti-RootkitLooks like you ran it but almost a 13mb log is unusual and I'm not going to download it to my computer.Do you remember if it found and fixed anything??MrC Link to post Share on other sites More sharing options...
Chris1 Posted December 27, 2012 Author ID:627440 Share Posted December 27, 2012 MBAR = Malwarebytes Anti-RootkitLooks like you ran it but almost a 13mb log is unusual and I'm not going to download it to my computer.Do you remember if it found and fixed anything??MrCNo, all it did was make a folder with with a bunch of files .I didn't click anything accpet the link you gave me. Then saved onto desktop. Then opened folder.there is a bunch of files but none with that name. There are names like mbar, mbam.dll, mbamnet.dll ect. Should I just run the one that says "mbar" despitte the fact in doesn't have "exe" at the end? Link to post Share on other sites More sharing options...
MrCharlie Posted December 28, 2012 ID:627448 Share Posted December 28, 2012 Here's the tutorial with pictures, please follow it, MrChttp://www.bleepingcomputer.com/virus-removal/how-to-use-malwarebytes-anti-rootkit Link to post Share on other sites More sharing options...
Chris1 Posted December 28, 2012 Author ID:627499 Share Posted December 28, 2012 here are the logs from the scanmbar-log-2012-12-27 (20-26-39).txtsystem-log.txt Link to post Share on other sites More sharing options...
MrCharlie Posted December 28, 2012 ID:627503 Share Posted December 28, 2012 That scan looked OK.............Please download and run ComboFix.The most important things to remember when running it is to disable all your malware programs and run Combofix from your desktop.Please visit this webpage for download links, and instructions for running ComboFixhttp://www.bleepingc...to-use-combofixEnsure you have disabled all anti virus and anti malware programs so they do not interfere with the running of ComboFix.Information on disabling your malware programs can be found Here.Make sure you run ComboFix from your desktop. Give it at least 30-45 minutes to finish if needed.Please include the C:\ComboFix.txt in your next reply for further review.---------->NOTE<----------If you get the message Illegal operation attempted on registry key that has been marked for deletion after you run ComboFix....please reboot the computer, this should resolve the problem. You may have to do this several times if needed.MrC Link to post Share on other sites More sharing options...
Chris1 Posted December 28, 2012 Author ID:627586 Share Posted December 28, 2012 Actually, I ran MAMB this morning and nothing was found. Hadn't even downloaded combo fix yet. Should I just forget that now and delete all the other stuff I've saved on my desktop during this process? Link to post Share on other sites More sharing options...
MrCharlie Posted December 28, 2012 ID:627602 Share Posted December 28, 2012 We'll cleanup all the logs and tools when we are done.Please run ComboFix and post the log, MrC Link to post Share on other sites More sharing options...
Chris1 Posted December 28, 2012 Author ID:627619 Share Posted December 28, 2012 Okay, here is crazy stupid question....but how do I ensure Ive disabled all the other anti-virus programs as intructed? Link to post Share on other sites More sharing options...
MrCharlie Posted December 28, 2012 ID:627623 Share Posted December 28, 2012 When you run ComboFix, it will warn you if you haven't disabled your anti-virus.Here's the link with instructions on how to disable them if needed:http://www.bleepingc...opic114351.htmlMrC Link to post Share on other sites More sharing options...
Chris1 Posted December 28, 2012 Author ID:627666 Share Posted December 28, 2012 When you run ComboFix, it will warn you if you haven't disabled your anti-virus.Here's the link with instructions on how to disable them if needed:http://www.bleepingc...opic114351.htmlMrCStrange, I followed the intructions on how to disable avg. When I open up avg is says "temperarily disabled" but when I try to run combofix it keeps saying AVG is active??? Link to post Share on other sites More sharing options...
MrCharlie Posted December 28, 2012 ID:627673 Share Posted December 28, 2012 That will happen sometimes, as long as you disabled it, you can ignore the warning and run ComboFix.MrC Link to post Share on other sites More sharing options...
Chris1 Posted December 29, 2012 Author ID:627878 Share Posted December 29, 2012 Ran it but cant find that report name. This was left on my desktop and hoping this is it.attach.txt Link to post Share on other sites More sharing options...
MrCharlie Posted December 29, 2012 ID:627933 Share Posted December 29, 2012 It should be here:C:\ComboFix.txtMrC Link to post Share on other sites More sharing options...
Chris1 Posted December 29, 2012 Author ID:627971 Share Posted December 29, 2012 It should be here:C:\ComboFix.txtMrCHi MrC.I don't understand this last post. All I can tell you is I ran the scan again. Then when it's done, there is some sort of log report that pops up.When I close that window it just seems to dissapear. When you say "it should be here C:\ComboFix.txt" am I supposed to type that somewhere on my computer? Link to post Share on other sites More sharing options...
Chris1 Posted December 29, 2012 Author ID:627974 Share Posted December 29, 2012 is this it?ComboFix.txt Link to post Share on other sites More sharing options...
MrCharlie Posted December 29, 2012 ID:627977 Share Posted December 29, 2012 Looks Good.....Please Update and run a Quick Scan with Malwarebytes Anti-Malware, post the report.Make sure that everything is checked, and click Remove Selected.Please let me know how computer is running now, MrC Link to post Share on other sites More sharing options...
Recommended Posts