Problem cleansing Trojan Ransom with Malwarebytes

[tocoin]

Hello. I have a Windows 7 Dell system. I use McAfee Security Center v11.6. Started getting Google (and Chrome) search re-directs. Could not solve/clean with McAfee. Installed Malwarebytes. Found/removed "Trojan.Ransom.Rel", but I continue to get messages like the following: "Malwarebytes blocked access to dangerous site 109.236.82.107 port 49648 (also has come up with other port numbers like 49556, 49578, 49551, 51850), process iexplore.exe". I followed the instructions and downloaded/ran DDS.scr and created DDS.txt and Attach.txt and I have attached them here. I would appreciate whatever help/advise you can provide on getting rid of this completely. Thank you very much.

Attach.txt

DDS.txt

[CatByte]

Hello and welcome to Malwarebytes

Please run the following:

Please download Farbar Recovery Scan Tool and save it to your desktop.

Note: You need to run the version compatible with your system. If you are not sure which version applies to your system download both of them and try to run them. Only one of them will run on your system, that will be the right version.

• Double-click to run it. When the tool opens click Yes to disclaimer.
  
• Press Scan button.
  
• It will make a log (FRST.txt) in the same directory the tool is run. Please copy and paste it to your reply.
  
• The first time the tool is run, it makes also another log (Addition.txt). Please attach it to your reply.
  

[tocoin]

^{Thanks. I did as you asked and downloaded and ran FARBAR/FRST. I have attached the two files/reports that were produced to this reply, FRST.txt and Addition.txt I appreciate you advise/help. Regards,}

Addition.txt

FRST.txt

[tocoin]

Also, I re-ran Malwarebytes after being on-line to do the task above in my reply. While it was running, it displayed a messasge indicating Trojan was removed, and after it had run, the report indicated Trojan.Agent had been quarantined:

Registry Value: HKCU\Software\Microsoft\Windows\CurrentVersion\RunlwabEventSupport16

File: C:\Users\tocoin\AppData\Roaming\wabEventSupport16\wabEventSupport16.dll

Memory Module: Same C:\... file path as above in File:

Regards,

[CatByte]

Download attached fixlist.txt file and save it to the Desktop.

NOTE. It's important that both files, FRST and fixlist.txt are in the same location or the fix will not work.

(Running from C:\FARBAR <- FIXLIST.TXT MUST BE SAVED TO THIS SAME FOLDER)

NOTICE: This script was written specifically for this user, for use on that particular machine. Running this on another machine may cause damage to your operating system

Run FRST64 and press the Fix button just once and wait.

The tool will make a log on the Desktop (Fixlog.txt). Please post it to your reply.

FixList.txt

NEXT

Refer to the ComboFix User's Guide

1. Download ComboFix from the following location:
   Link
   * IMPORTANT !!! Place ComboFix.exe on your Desktop
   
2. Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with ComboFix.
   You can get help on disabling your protection programs here
   
3. Double click on ComboFix.exe & follow the prompts.
   
4. Your desktop may go blank. This is normal. It will return when ComboFix is done. ComboFix may reboot your machine. This is normal.
   
5. When finished, it shall produce a log for you. Post that log in your next reply
   Note:
   Do not mouseclick combofix's window whilst it's running. That may cause it to stall.
   ---------------------------------------------------------------------------------------------
   
6. Ensure your AntiVirus and AntiSpyware applications are re-enabled.
   ---------------------------------------------------------------------------------------------

NOTE: If you encounter a message "illegal operation attempted on registry key that has been marked for deletion" and no programs will run - please just reboot and that will resolve that error.

[tocoin]

I have run FRST64 as requested and clicked on FIX. It completed successfully and I then rebooted. Reboot was very slow, but finally completed. I have attached the Fixlog.txt file as requested.

Fixlog.txt

[tocoin]

Ran Combofix.exe as instructed. I have attached the log file to this reply. I will note that even as the Combofix log was completed, I got 1 message each from Malwarebytes and McAfee about Trojans that were caught and quarantined. Malwarebytes caught C:\users\tocoin\Appdata\roaming\Mozilla\Winde34.exe, and McAfee caught and quarantined C:\users\tocoin\Appdata\local\netscape\gwujweuu.dll Should I have disconnected myself from the Internet while I was running the cleanup programs and combofix? Not sure if I am clean or if it still lingers. Again, thanks for the help and advise.

ComboFix.txt

[CatByte]

Please run the following:

Please create a new system restore point before running Malwarebytes Anti-Rootkit if you can.

MBAR tutorial

Download Malwarebytes Anti-Rootkit from HERE

• Unzip the contents to a folder in a convenient location.
  
• Open the folder where the contents were unzipped and run mbar.exe
  
• Follow the instructions in the wizard to update and allow the program to scan your computer for threats.
  
• Click on the Cleanup button to remove any threats and reboot if prompted to do so.
  
• Wait while the system shuts down and the cleanup process is performed.
  
• Perform another scan with Malwarebytes Anti-Rootkit to verify that no threats remain. If they do, then click Cleanup once more and repeat the process.
  
• When done, please post the two logs produced they will be in the MBAR folder..... mbar-log.txt and system-log.txt
  

~~~~~~~~~~~~~~~~~~~~~~~

Note:

If no additional threats were found, verify that your system is now running normally, making sure that the following items are functional:

Internet access

Windows Update

Windows Firewall

If there are additional problems with your system, such as any of those listed above or other system issues, then run the fixdamage tool included with Malwarebytes Anti-Rootkit and reboot.

Verify that your system is now functioning normally.

[tocoin]

OK, I Created a system restore point, and then downloaded and ran mbar.exe (anti-rootkit). It ran to completion and reported the system was clean after the scan, so a clean up and re-boot was not required. I have attached the two requested files to this reply. "mbar-log-2013-06-02 (10-53-44).txt" and "system-log.txt". I had paused a McAfee scan, and restarted it after this completed. It reported one Trojan discovered and quarantined, so once that scan finished, I will be re-scanning with MalwareBytes and re-running mbar.exe just to make sure I am clean. My Internet service seems to be operating normally, and I will check my Windows Updates and Windows firewall and report back again. Thanks,

mbar-log-2013-06-02 (10-53-44).txt

system-log.txt

[CatByte]

ok, good, please make sure you use the fixdamage tool if there are any issues with those Windows Services, then run the following (we need to check for any leftovers)

Please download Junkware Removal Tool to your desktop.

• Shutdown your antivirus to avoid any conflicts.
  
• Right-mouse click JRT.exe and select Run as administrator
  
• The tool will open and start scanning your system.
  
• Please be patient as this can take a while to complete.
  
• On completion, a log (JRT.txt) is saved to your desktop and will automatically open.
  
• Post the contents of JRT.txt into your next message
  

NEXT

Download AdwCleaner from here and save it to your desktop.

• Run AdwCleaner and select Delete
  
• Once done it will ask to reboot, allow the reboot
  
• On reboot a log will be produced, please attach the content of the log to your next reply
  

NEXT

• Please open your MalwareBytes AntiMalware Program
  
• Click the Update Tab and search for updates
  
• If an update is found, it will download and install the latest version.
  
• Once the program has loaded, select "Perform Quick Scan", then click Scan.
  
• The scan may take some time to finish, so please be patient.
  
• When the scan is complete, click OK, then Show Results to view the results.
  
• Make sure that everything is checked, and click Remove Selected. <-- very important
  
• When disinfection is completed, a log will open in Notepad and you may be prompted to Restart. (See Extra Note)
  
• The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM.
  
• Copy&Paste the entire report in your next reply.
  

Extra Note:If MBAM encounters a file that is difficult to remove, you will be presented with 1 of 2 prompts, click OK to either and let MBAM proceed with the disinfection process, if asked to restart the computer, please do so immediately.

NEXT

Go here to run an online scanner from ESET.

• Turn off the real time scanner of any existing antivirus program while performing the online scan
  
• Tick the box next to YES, I accept the Terms of Use.
  
• Click Start
  
• When asked, allow the activeX control to install
  
• Click Start
• Make sure that the option Remove found threats is unticked and the Scan Archives option is ticked.
  
• Click on Advanced Settings, ensure the options Scan for potentially unwanted applications, Scan for potentially unsafe applications, and Enable Anti-Stealth Technology are ticked.
  
• Click Scan
  
• Wait for the scan to finish
  
• When the scan completes, press the LIST OF THREATS FOUND button
  
• Press EXPORT TO TEXT FILE , name the file ESETSCAN and save it to your desktop
  
• Include the contents of this report in your next reply.
  
• Press the BACK button.
  
• Press Finish
  

[tocoin]

OK, I had to be away, but am back to this and will try. PC seemed OK for a few days, but now Internet access is down on it, so I will be back looking at it later today. If I can get Internet access, I will try the final steps you recommended in your last post. I fear it was not clean and Internet access got disabled by what was still on PC. Wireless router/DSL Modem has all green lights, looks clean.

[tocoin]

May have been unrelated, power surge or something, was able to restore internet service working with provider Verizon....will try your last suggested steps this evening and post back afterwards.

[tocoin]

OK, followed the steps you suggested, running a) JRT, b) AdWcleaner, c)MalwareBytes scan, d) ESET scan. All of the requested log files and reports are attached to this reply. I also have a couple other notes/comments. 1) In step c) while Malwarebytes was running, I got a pop up from McAfee AV that a Trojan was detected and removed: RDN/Generic.dx!c2i quarantined from C:\users\tocoin\appdata\local\temp\synsxrc\stiumrv\wow.dll. Also, a question: Your instructions were to unclick the option for ESET to remove any threats found. ESET identified seven threats, all various Trojans. Why not have ESET remove them? Now that ESET finished, are they still there? Should I run it again and remove them? Again, thanks for sticking with me on the problem

ESETSCAN.txt

mbam-log-2013-06-08 (13-52-05).txt

AdwCleanerS1.txt

JRT.txt

[CatByte]

sometimes ESET finds files that are falsepositives and shouldn't be removed, so i like to get a look first.

Please run the following:

• Very Important! Temporarily disable your anti-virus, script blocking and any anti-malware real-time protection before following the steps below.
  
• They can interfere with ComboFix or remove some of its embedded files which may cause "unpredictable results".
  

Copy/paste the text inside the Codebox below into notepad:

Here's how to do that:

Press the WinKey + R to open a run box, type Notepad > click OK.

This will open an empty notepad file:

Copy all the text inside of the code box - Press Ctrl+C (or right click on the highlighted section and choose 'copy')

File::
C:\Users\tocoin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\24\1e907a98-3cdaa136	
C:\Users\tocoin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\46\33db3f6e-44b8f826	
C:\Users\tocoin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\62\28acb0fe-3e46fd4e	
C:\Users\tocoin\AppData\Roaming\wabEventSupport16\{a1a114b7-f82a-4ec9-598b-5a7e99cb6380}.exe

ClearJavaCache::

Now paste the copied text into the open notepad - press CTRL+V (or right click and choose 'paste')

Save this file to your desktop, Save this as "CFScript"

Here's how to do that:

1.Click File;

2.Click Save As... Change the directory to your desktop;

3.Change the Save as type to "All Files";

4.Type in the file name: CFScript

5.Click Save ...

• Referring to the screenshot above, drag CFScript.txt into ComboFix.exe.
  
• ComboFix may request an update; please allow it.
  
• ComboFix will now run a scan on your system. It may reboot your system when it finishes. This is normal.
  
• When finished, it shall produce a log for you.
  
• Copy and paste the contents of the log in your next reply.
  

CAUTION: Do not mouse-click ComboFix's window while it is running. That may cause it to stall.

NEXT

Please advise how the computer is running now and if there are any outstanding issues

[tocoin]

OK, thanks....I have attached the Combfix log to this reply. The systems appears to be running well at this point. Just want to make sure I am clean! Thanks.

Combofixlog.txt

[CatByte]

Please run the following:

Visit ADOBE and download the latest version of Acrobat Reader (version XI)

Having the latest updates ensures there are no security vulnerabilities in your system.

Decline any additional installs that may be offered.

NEXT

Your Java is out of date. Older versions have vulnerabilities that malware can use to infect your system. Please follow these steps to remove older version Java components and update.

• Download the latest version of Java Runtime Environment (JRE) 7 and Save it to your Desktop.
• Scroll down to where it says Java SE 7u21
• Click the Download button under JRE to the right.
• Read the License Agreement then select Accept License Agreement
• Click on the link to download Windows x86 Offline and save the file to your desktop.
• Close any programs you may have running - especially your web browser.
• Go to Start > Control Panel, double-click on Add or Remove Programs and remove all older versions of Java.
• Check (highlight) any item with Java Runtime Environment (JRE or J2SE or Java 6) in the name.
• Click the Remove or Change/Remove button.
• Repeat as many times as necessary to remove each Java versions.
• Reboot your computer once all Java components are removed.
• Then from your desktop double-click on jre-7u21-windows-i586.exe to install the newest version.
  
• Decline any additional installs that may be offered.
  

• After the install is complete, go into the Control Panel (using Classic View) and double-click the Java Icon. (looks like a coffee cup)
  • On the General tab, under Temporary Internet Files, click the Settings button.
  • Next, click on the Delete Files button
  • There are three options in the window to clear the cache - Leave these two Checked
    
    • 
      Trace and Log Files
      Cached Applications and Applets
  • Click OK on Delete Temporary Files Window
    Note: This deletes ALL the Downloaded Applications and Applets from the CACHE.
  • Click OK to leave the Temporary Files Window
  • Click OK to leave the Java Control Panel.

NEXT

Please let me know if there are any outstanding issues

[tocoin]

Thanks. I updated to the latest version of the Adobe reader, and de-installed JAVA and reinstalled the latest version. I re-ran a quick scan on MalwareBytes and there were no problems detected. I have no other problems that have occurred or popped up, so I believe I am all set. Thank you very much for all your assistance and guidance. Regards,

[CatByte]

We just have some housekeeping to do now,

Please do the following:

You can delete the FRST, JRT and MBAR logs and programs from your desktop.

NEXT

Follow these steps to uninstall Combofix

• Make sure your security programs are totally disabled.
  
• Press the WinKey +R to open a run box
  
• Now copy/paste Combofix /uninstall into the runbox and click OK. Note the space between the ..X and the /U, it needs to be there.
  

NEXT

• Double click on adwcleaner.exe to run the tool.
  
• Click on Uninstall.
  
• Confirm with yes.
  

If there are any logs/tools remaining on your desktop > right click and delete them.

NEXT

Below I have included a number of recommendations for how to protect your computer against malware infections.

• It is good security practice to change your passwords to all your online accounts on a fairly regular basis, this is especially true after an infection. Refer to this Microsoft article
  Strong passwords: How to create and use them Then consider a password keeper, to keep all your passwords safe. KeePass is a small utility that allows you to manage all your passwords.
  
• Keep Windows updated by regularly checking their website at :
  http://windowsupdate.microsoft.com/
  This will ensure your computer has always the latest security updates available installed on your computer.
  
• Make Internet Explorer more secure
  
  • Click Start > Run
    
  • Type Inetcpl.cpl & click OK
    
  • Click on the Security tab
    
  • Click Reset all zones to default level
    
  • Make sure the Internet Zone is selected & Click Custom level
    
  • In the ActiveX section, set the first two options ("Download signed and unsigned ActiveX controls) to "Prompt", and ("Initialize and Script ActiveX controls not marked as safe") to "Disable".
    
  • Next Click OK, then Apply button and then OK to exit the Internet Properties page.
    

  [*]Download TFC to your desktop

  • Close any open windows.
    
  • Double click the TFC icon to run the program
    
  • TFC will close all open programs itself in order to run,
    
  • Click the Start button to begin the process.
    
  • Allow TFC to run uninterrupted.
    
  • The program should not take long to finish it's job
    
  • Once its finished it should automatically reboot your machine,
    
  • if it doesn't, manually reboot to ensure a complete clean
    

  It's normal after running TFC cleaner that the PC will be slower to boot the first time.

  [*]WOT, Web of Trust, warns you about risky websites that try to scam visitors, deliver malware or send spam. Protect your computer against online threats by using WOT as your front-line layer of protection when browsing or searching in unfamiliar territory. WOT's color-coded icons show you ratings for 21 million websites, helping you avoid the dangerous sites:

  • Green to go
    
  • Yellow for caution
    
  • Red to stop
    

  WOT has an addon available for both Firefox and IE

  [*]Keep a backup of your important files - Now, more than ever, it's especially important to protect your digital files and memories. This article is full of good information on alternatives for home backup solutions.

  [*]In light of your recent issue, I'm sure you'd like to avoid any future infections. Please take a look at these well written articles:

  PC Safety and Security--What Do I Need?.

  [*]Simple and easy ways to keep your computer safe and secure on the Internet

Thank you for your patience, and performing all of the procedures requested.

Please respond one last time so we can consider the thread resolved and close it, thank-you.

[tocoin]

OK, thanks...I deleted the FRST, JRT and MBAR logs and programs from my desktop and uninstalled Combofix.  I uninstalled adwcleaner.  I followed the instructions on setting IE properties.  I downloaded/ran TFC.  I'll read through the other info/material you have recommended. Thanks for all the help!  Regards,

[CatByte]

you are welcome

 

stay safe

 

~CB

[CatByte]

Since this issue is resolved I will close the thread to prevent others from posting here. If you need assistance please start your own topic and someone will be happy to assist you.