Jump to content

FBI money pack logs


Recommended Posts

I'm working on trying to remove the FBI moneypack virus from a friends machine. Here is the log that im getting from the FRST scan. Any help would be appreciated. I see that the winlogon needs attention but im sure sure what registry changes I need to make to get it to boot safe mode. Currently the machine is restarting as soon as safe mode is entered.

FRST.txt

Link to post
Share on other sites

Hello rhillery and :welcome:! My name is Maniac and I will be glad to help you solve your malware problem.

Please note:

  • If you are a paying customer, you have the privilege to contact the help desk at Consumer Support. If you choose this option to get help, please let me know.
  • I recommend you to keep the instructions I will be giving you so that they are available to you at any time. You can save them in a text file or print them.
  • Make sure you read all of the instructions and fixes thoroughly before continuing with them.
  • Follow my instructions strictly and don’t hesitate to stop and ask me if you have any questions.
  • Post your log files, don't attach them. Every log file should be copy/pasted in your next reply.
  • Do not perform any kind of scanning and fixing without my instructions. If you want to proceed on your own, please let me know.

Open Notepad (Start => All Programs => Accessories => Notepad). Please copy the entire contents of the code box below. (To do this highlight the contents of the box, right click on it and select copy. Right-click in the open Notepad and select Paste). Save it on the flashdrive as fixlist.txt

HKLM-x32\...\Run: [] [x]

HKU\Christopher\...\Run: [qcgce2mrvjq91kk1e7pnbb19m52fx] C:\Users\Christopher\Documents\43a7947f.exe [31744 2013-05-13] ()

HKU\Christopher\...\Winlogon: [shell] cmd.exe [345088 2010-11-20] (Microsoft Corporation)

2013-05-13 09:38 - 2013-05-13 09:38 - 00404884 ____A C:\Users\Christopher\AppData\Local\2433f433

2013-05-13 09:38 - 2013-05-13 09:38 - 00404861 ____A C:\ProgramData\2433f433

2013-05-13 09:38 - 2013-05-13 09:38 - 00404839 ____A C:\Users\Christopher\AppData\Roaming\2433f433

2013-05-13 09:38 - 2013-05-13 09:38 - 00031744 ____A C:\Users\Christopher\Documents\43a7947f.exe

NOTICE: This script was written specifically for this user, for use on this particular machine. Running this on another machine may cause damage to your operating system

Now please enter System Recovery Options then select Command Prompt

Run FRST (or FRST64 if you have the 64bit version) and press the Fix button just once and wait.

The tool will make a log on the flashdrive (Fixlog.txt) please post it to your reply.

Reboot Normally.

Link to post
Share on other sites

Maniac, thank you so much. That allowed me to get into safe mode without the machine rebooting. If I might ask, how were you able to determine what to put into fixlist.txt file? I do virus removal regularly and this would be helpful to know. Also, here is the fixlog.

Fix result of Farbar Recovery Tool (FRST written by Farbar) (x64) Version: 14-05-2013

Ran by SYSTEM at 2013-05-14 14:24:28 Run:2

Running from H:\

Boot Mode: Recovery

==============================================

HKLM\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\\ => Value deleted successfully.

HKEY_USERS\Christopher\Software\Microsoft\Windows\CurrentVersion\Run\\qcgce2mrvjq91kk1e7pnbb19m52fx => Value deleted successfully.

HKEY_USERS\Christopher\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\\Shell => Value deleted successfully.

C:\Users\Christopher\AppData\Local\2433f433 => Moved successfully.

C:\ProgramData\2433f433 => File/Directory not found.

C:\Users\Christopher\AppData\Roaming\2433f433 => Moved successfully.

C:\Users\Christopher\Documents\43a7947f.exe => Moved successfully.

==== End of Fixlog ====

Link to post
Share on other sites

If I might ask, how were you able to determine what to put into fixlist.txt file? I do virus removal regularly and this would be helpful to know.

If you want to know: how, why, what and when =>

http://forums.malwarebytes.org/index.php?showtopic=12264&view=findpost&p=62319

If you coudn't run it at Normal mode, try at Safe mode with Networking:

Note: Please do not run this tool without special supervision and instructions of someone authorized to do so. Otherwise, you could end up with serious problems. For more details, read this article: ComboFix usage, Questions, Help? - Look here

Please visit this webpage for download links, and instructions for running the tool:

http://www.bleepingc...to-use-combofix

* Ensure you have disabled all anti virus and anti malware programs so they do not interfere with the running of ComboFix.

Please post the C:\ComboFix.txt in your next reply for further review.

Note: If you encounter a message "illegal operation attempted on registry key that has been marked for deletion" and no programs will run - please just reboot and that will resolve that error.

Link to post
Share on other sites

  • 2 weeks later...

Due to the lack of feedback this topic is closed to prevent others from posting here. If you need this topic reopened, please send a Private Message to any one of the moderating team members. Please include a link to this thread with your request. This applies only to the originator of this thread.

Other members who need assistance please start your own topic in a new thread. Thanks!

Link to post
Share on other sites

Guest
This topic is now closed to further replies.
  • Recently Browsing   0 members

    • No registered users viewing this page.
Back to top
×
×
  • Create New...

Important Information

This site uses cookies - We have placed cookies on your device to help make this website better. You can adjust your cookie settings, otherwise we'll assume you're okay to continue.