Another case of Trojan Ramson and Pum.userWLoad

[alwaysactive]

First of all, I want to say that I have been using your software for years and I have highly recommended it to friends and associates. I have NEVER had a case where it would not remove something...until now...

I have run things as directed and I am attaching the logs...

I have also run RogueKiller and here is the report from that....

Thanks in advance for all of the help...truly a priceless resource!

RogueKiller V8.4.3 [Jan 10 2013] by Tigzy

mail : tigzyRK<at>gmail<dot>com

Feedback : http://www.geekstogo.com/forum/files/file/413-roguekiller/

Website : http://tigzy.geekstogo.com/roguekiller.php

Blog : http://tigzyrk.blogspot.com/

Operating System : Windows 7 (6.1.7601 Service Pack 1) 64 bits version

Started in : Normal mode

User : Cristina [Admin rights]

Mode : Scan -- Date : 01/14/2013 12:02:16

¤¤¤ Bad processes : 2 ¤¤¤

[sUSP PATH] VPDAgent_x64.exe -- C:\Windows\VPDAgent_x64.exe -> KILLED [TermProc]

[sUSP PATH] FacebookMessenger.exe -- C:\Users\Cristina\AppData\Local\Facebook\Messenger\2.1.4651.0\FacebookMessenger.exe -> KILLED [TermProc]

¤¤¤ Registry Entries : 5 ¤¤¤

[sHELL][sUSP PATH] HKCU\[...]\Windows : Load (C:\Users\Cristina\LOCALS~1\Temp\msfuaz.cmd) -> FOUND

[sHELL][sUSP PATH] HKUS\S-1-5-21-3522182554-3549564140-759061784-1001[...]\Windows : Load (C:\Users\Cristina\LOCALS~1\Temp\msfuaz.cmd) -> FOUND

[sTARTUP][sUSP PATH] Facebook Messenger.lnk @Cristina : C:\Users\Cristina\AppData\Local\Facebook\Messenger\2.1.4651.0\FacebookMessenger.exe -> FOUND

[HJ DESK] HKLM\[...]\NewStartPanel : {59031a47-3f72-44a7-89c5-5595fe6b30ee} (1) -> FOUND

[HJ DESK] HKLM\[...]\NewStartPanel : {20D04FE0-3AEA-1069-A2D8-08002B30309D} (1) -> FOUND

¤¤¤ Particular Files / Folders: ¤¤¤

[ZeroAccess][FOLDER] U : C:\$recycle.bin\S-1-5-21-3522182554-3549564140-759061784-1001\$4206307d8b54c6ca17655e4408db4d36\U --> FOUND

[ZeroAccess][FOLDER] L : C:\$recycle.bin\S-1-5-21-3522182554-3549564140-759061784-1001\$4206307d8b54c6ca17655e4408db4d36\L --> FOUND

¤¤¤ Driver : [NOT LOADED] ¤¤¤

¤¤¤ Infection : ZeroAccess ¤¤¤

¤¤¤ HOSTS File: ¤¤¤

--> C:\Windows\system32\drivers\etc\hosts

¤¤¤ MBR Check: ¤¤¤

+++++ PhysicalDrive0: Hitachi HTS547564A9E384 SATA Disk Device +++++

--- User ---

[MBR] 46f924c95dcab07114b15913232462b7

[bSP] c920c50bf185857def37a52a031cf7d1 : Windows 7/8 MBR Code

Partition table:

0 - [ACTIVE] NTFS (0x07) [VISIBLE] Offset (sectors): 2048 | Size: 199 Mo

1 - [XXXXXX] NTFS (0x07) [VISIBLE] Offset (sectors): 409600 | Size: 584113 Mo

2 - [XXXXXX] NTFS (0x07) [VISIBLE] Offset (sectors): 1196673024 | Size: 22103 Mo

3 - [XXXXXX] FAT32-LBA (0x0c) [VISIBLE] Offset (sectors): 1241939968 | Size: 4063 Mo

User = LL1 ... OK!

User = LL2 ... OK!

Finished : << RKreport[1]_S_01142013_02d1202.txt >>

RKreport[1]_S_01142013_02d1202.txt

dds.txt

attach.txt

[MrCharlie]

Welcome to the forum.

Please read the following information first.

You're infected with Rootkit.ZeroAccess, a BackDoor Trojan.

BACKDOOR WARNING

------------------------------

One or more of the identified infections is known to use a backdoor.

This allows hackers to remotely control your computer, steal critical system information and download and execute files.

I would advice you to disconnect this PC from the Internet immediately. If you do any banking or other financial transactions on the PC or if it should contain any other sensitive information, please get to a known clean computer and change all passwords where applicable, and it would be wise to contact those same financial institutions to apprise them of your situation.

Though the infection has been identified and because of it's backdoor functionality, your PC is very likely compromised and there is no way to be sure your computer can ever again be trusted. Many experts in the security community believe that once infected with this type of trojan, the best course of action would be a reformat and reinstall of the OS. Please read these for more information:

How Do I Handle Possible Identify Theft, Internet Fraud and CC Fraud?

http://www.dslreports.com/faq/10451

When Should I Format, How Should I Reinstall

http://www.dslreports.com/faq/10063

I will try my best to clean this machine but I can't guarantee that it will be 100% secure afterwards.

Let me know what you decide to do. If you decide to go through with the cleanup, please proceed with the following steps.

-----------------------------------------

Run RogueKiller again and click Scan

When the scan completes > click on the Registry tab

Put a check next to all of these and uncheck the rest: (if found)

[sHELL][sUSP PATH] HKCU\[...]\Windows : Load (C:\Users\Cristina\LOCALS~1\Temp\msfuaz.cmd) -> FOUND

[sHELL][sUSP PATH] HKUS\S-1-5-21-3522182554-3549564140-759061784-1001[...]\Windows : Load (C:\Users\Cristina\LOCALS~1\Temp\msfuaz.cmd) -> FOUND

Now click Delete on the right hand column under Options

-------------

Next click on the Files tab and put a check next to these and uncheck the rest. (if found)

[ZeroAccess][FOLDER] U : C:\$recycle.bin\S-1-5-21-3522182554-3549564140-759061784-1001\$4206307d8b54c6ca17655e4408db4d36\U --> FOUND

[ZeroAccess][FOLDER] L : C:\$recycle.bin\S-1-5-21-3522182554-3549564140-759061784-1001\$4206307d8b54c6ca17655e4408db4d36\L --> FOUND

Now click Delete on the right hand column under Options

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Next...............

Please create a new system restore point before running Malwarebytes Anti-Rootkit if you can.

Download Malwarebytes Anti-Rootkit from HERE

• Unzip the contents to a folder in a convenient location.
  
• Open the folder where the contents were unzipped and run mbar.exe
  
• Follow the instructions in the wizard to update and allow the program to scan your computer for threats.
  
• Click on the Cleanup button to remove any threats and reboot if prompted to do so.
  
• Wait while the system shuts down and the cleanup process is performed.
  
• Perform another scan with Malwarebytes Anti-Rootkit to verify that no threats remain. If they do, then click Cleanup once more and repeat the process.
  
• When done, please post the two logs produced they will be in the MBAR folder..... mbar-log.txt and system-log.txt
  

To attach a log if needed:

Bottom right corner of this page.

New window that comes up.

~~~~~~~~~~~~~~~~~~~~~~~

Note:

If no additional threats were found, verify that your system is now running normally, making sure that the following items are functional:

Internet access

Windows Update

Windows Firewall

If there are additional problems with your system, such as any of those listed above or other system issues, then run the fixdamage tool included with Malwarebytes Anti-Rootkit and reboot.

Verify that your system is now functioning normally.

MrC

[alwaysactive]

OK, ran the Anti-Root Kit and it found something the first go 'round. It removed it successfully and second scan of ARK is clean. But I cant find the logs at all...even with a search...ugh. Any ideas?

Im going to run MB again...anything other recommendations?

Thanks sooo much! You have been a life saver!

[MrCharlie]

Look in the MBAR folder:

There will now be two log files created in the mbar folder called system-log.txt and one that starts withmbar-log. The mbar-log file will always start with mbar-log, but the rest will be named using a timestamp indicating the time it was run. For example, mbar-log-2012-11-12 (19-13-32).txt corresponds to mbar-log-year-month-day (hour-minute-second).txt. The system-log.txt contains information about each time you have run MBAR and contains diagnostic information from the program. A new mbar-log is created every time you run MBAR and will contain information about what was detected and removed.

MrC

[Maurice Naggar]

Due to the lack of feedback this topic is closed to prevent others from posting here. If you need this topic reopened, please send a Private Message to any one of the moderating team members. Please include a link to this thread with your request. This applies only to the originator of this thread.

Other members who need assistance please start your own topic in a new thread. Thanks!