Jump to content

Problem cleansing Trojan Ransom with Malwarebytes

Recommended Posts

Hello. I have a Windows 7 Dell system. I use McAfee Security Center v11.6. Started getting Google (and Chrome) search re-directs. Could not solve/clean with McAfee. Installed Malwarebytes. Found/removed "Trojan.Ransom.Rel", but I continue to get messages like the following: "Malwarebytes blocked access to dangerous site port 49648 (also has come up with other port numbers like 49556, 49578, 49551, 51850), process iexplore.exe". I followed the instructions and downloaded/ran DDS.scr and created DDS.txt and Attach.txt and I have attached them here. I would appreciate whatever help/advise you can provide on getting rid of this completely. Thank you very much.



Link to post
Share on other sites

  • Staff

Hello and welcome to Malwarebytes

Please run the following:

Please download Farbar Recovery Scan Tool and save it to your desktop.

Note: You need to run the version compatible with your system. If you are not sure which version applies to your system download both of them and try to run them. Only one of them will run on your system, that will be the right version.

  • Double-click to run it. When the tool opens click Yes to disclaimer.
  • Press Scan button.
  • It will make a log (FRST.txt) in the same directory the tool is run. Please copy and paste it to your reply.
  • The first time the tool is run, it makes also another log (Addition.txt). Please attach it to your reply.

Link to post
Share on other sites

Also, I re-ran Malwarebytes after being on-line to do the task above in my reply. While it was running, it displayed a messasge indicating Trojan was removed, and after it had run, the report indicated Trojan.Agent had been quarantined:

Registry Value: HKCU\Software\Microsoft\Windows\CurrentVersion\RunlwabEventSupport16

File: C:\Users\tocoin\AppData\Roaming\wabEventSupport16\wabEventSupport16.dll

Memory Module: Same C:\... file path as above in File:


Link to post
Share on other sites

  • Staff

Download attached fixlist.txt file and save it to the Desktop.

NOTE. It's important that both files, FRST and fixlist.txt are in the same location or the fix will not work.


NOTICE: This script was written specifically for this user, for use on that particular machine. Running this on another machine may cause damage to your operating system

Run FRST64 and press the Fix button just once and wait.

The tool will make a log on the Desktop (Fixlog.txt). Please post it to your reply.



Refer to the ComboFix User's Guide

  1. Download ComboFix from the following location:
    * IMPORTANT !!! Place ComboFix.exe on your Desktop
  2. Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with ComboFix.
    You can get help on disabling your protection programs here
  3. Double click on ComboFix.exe & follow the prompts.
  4. Your desktop may go blank. This is normal. It will return when ComboFix is done. ComboFix may reboot your machine. This is normal.
  5. When finished, it shall produce a log for you. Post that log in your next reply
    Do not mouseclick combofix's window whilst it's running. That may cause it to stall.
  6. Ensure your AntiVirus and AntiSpyware applications are re-enabled.

NOTE: If you encounter a message "illegal operation attempted on registry key that has been marked for deletion" and no programs will run - please just reboot and that will resolve that error.

Link to post
Share on other sites

Ran Combofix.exe as instructed. I have attached the log file to this reply. I will note that even as the Combofix log was completed, I got 1 message each from Malwarebytes and McAfee about Trojans that were caught and quarantined. Malwarebytes caught C:\users\tocoin\Appdata\roaming\Mozilla\Winde34.exe, and McAfee caught and quarantined C:\users\tocoin\Appdata\local\netscape\gwujweuu.dll Should I have disconnected myself from the Internet while I was running the cleanup programs and combofix? Not sure if I am clean or if it still lingers. Again, thanks for the help and advise.


Link to post
Share on other sites

  • Staff

Please run the following:

Please create a new system restore point before running Malwarebytes Anti-Rootkit if you can.

MBAR tutorial

Download Malwarebytes Anti-Rootkit from HERE

  • Unzip the contents to a folder in a convenient location.
  • Open the folder where the contents were unzipped and run mbar.exe
  • Follow the instructions in the wizard to update and allow the program to scan your computer for threats.
  • Click on the Cleanup button to remove any threats and reboot if prompted to do so.
  • Wait while the system shuts down and the cleanup process is performed.
  • Perform another scan with Malwarebytes Anti-Rootkit to verify that no threats remain. If they do, then click Cleanup once more and repeat the process.
  • When done, please post the two logs produced they will be in the MBAR folder..... mbar-log.txt and system-log.txt



If no additional threats were found, verify that your system is now running normally, making sure that the following items are functional:

Internet access

Windows Update

Windows Firewall

If there are additional problems with your system, such as any of those listed above or other system issues, then run the fixdamage tool included with Malwarebytes Anti-Rootkit and reboot.

Verify that your system is now functioning normally.

Link to post
Share on other sites

OK, I Created a system restore point, and then downloaded and ran mbar.exe (anti-rootkit). It ran to completion and reported the system was clean after the scan, so a clean up and re-boot was not required. I have attached the two requested files to this reply. "mbar-log-2013-06-02 (10-53-44).txt" and "system-log.txt". I had paused a McAfee scan, and restarted it after this completed. It reported one Trojan discovered and quarantined, so once that scan finished, I will be re-scanning with MalwareBytes and re-running mbar.exe just to make sure I am clean. My Internet service seems to be operating normally, and I will check my Windows Updates and Windows firewall and report back again. Thanks,

mbar-log-2013-06-02 (10-53-44).txt


Link to post
Share on other sites

  • Staff

ok, good, please make sure you use the fixdamage tool if there are any issues with those Windows Services, then run the following (we need to check for any leftovers)

Please download Junkware Removal Tool to your desktop.

  • Shutdown your antivirus to avoid any conflicts.
  • Right-mouse click JRT.exe and select Run as administrator
  • The tool will open and start scanning your system.
  • Please be patient as this can take a while to complete.
  • On completion, a log (JRT.txt) is saved to your desktop and will automatically open.
  • Post the contents of JRT.txt into your next message


Download AdwCleaner from here and save it to your desktop.

  • Run AdwCleaner and select Delete
  • Once done it will ask to reboot, allow the reboot
  • On reboot a log will be produced, please attach the content of the log to your next reply


  • Please open your MalwareBytes AntiMalware Program
  • Click the Update Tab and search for updates
  • If an update is found, it will download and install the latest version.
  • Once the program has loaded, select "Perform Quick Scan", then click Scan.
  • The scan may take some time to finish, so please be patient.
  • When the scan is complete, click OK, then Show Results to view the results.
  • Make sure that everything is checked, and click Remove Selected. <-- very important
  • When disinfection is completed, a log will open in Notepad and you may be prompted to Restart. (See Extra Note)
  • The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM.
  • Copy&Paste the entire report in your next reply.

Extra Note:If MBAM encounters a file that is difficult to remove, you will be presented with 1 of 2 prompts, click OK to either and let MBAM proceed with the disinfection process, if asked to restart the computer, please do so immediately.


Go here to run an online scanner from ESET.

  • Turn off the real time scanner of any existing antivirus program while performing the online scan
  • Tick the box next to YES, I accept the Terms of Use.
  • Click Start
  • When asked, allow the activeX control to install
  • Click Start
  • Make sure that the option Remove found threats is unticked and the Scan Archives option is ticked.
  • Click on Advanced Settings, ensure the options Scan for potentially unwanted applications, Scan for potentially unsafe applications, and Enable Anti-Stealth Technology are ticked.
  • Click Scan
  • Wait for the scan to finish
  • When the scan completes, press the LIST OF THREATS FOUND button
  • Press EXPORT TO TEXT FILE , name the file ESETSCAN and save it to your desktop
  • Include the contents of this report in your next reply.
  • Press the BACK button.
  • Press Finish

Link to post
Share on other sites

OK, I had to be away, but am back to this and will try. PC seemed OK for a few days, but now Internet access is down on it, so I will be back looking at it later today. If I can get Internet access, I will try the final steps you recommended in your last post. I fear it was not clean and Internet access got disabled by what was still on PC. Wireless router/DSL Modem has all green lights, looks clean.

Link to post
Share on other sites

OK, followed the steps you suggested, running a) JRT, b) AdWcleaner, c)MalwareBytes scan, d) ESET scan. All of the requested log files and reports are attached to this reply. I also have a couple other notes/comments. 1) In step c) while Malwarebytes was running, I got a pop up from McAfee AV that a Trojan was detected and removed: RDN/Generic.dx!c2i quarantined from C:\users\tocoin\appdata\local\temp\synsxrc\stiumrv\wow.dll. Also, a question: Your instructions were to unclick the option for ESET to remove any threats found. ESET identified seven threats, all various Trojans. Why not have ESET remove them? Now that ESET finished, are they still there? Should I run it again and remove them? Again, thanks for sticking with me on the problem


mbam-log-2013-06-08 (13-52-05).txt



Link to post
Share on other sites

  • Staff

sometimes ESET finds files that are falsepositives and shouldn't be removed, so i like to get a look first.

Please run the following:

  • Very Important! Temporarily disable your anti-virus, script blocking and any anti-malware real-time protection before following the steps below.
  • They can interfere with ComboFix or remove some of its embedded files which may cause "unpredictable results".

Copy/paste the text inside the Codebox below into notepad:

Here's how to do that:

Press the WinKey + R to open a run box, type Notepad > click OK.

This will open an empty notepad file:

Copy all the text inside of the code box - Press Ctrl+C (or right click on the highlighted section and choose 'copy')



Now paste the copied text into the open notepad - press CTRL+V (or right click and choose 'paste')

Save this file to your desktop, Save this as "CFScript"

Here's how to do that:

1.Click File;

2.Click Save As... Change the directory to your desktop;

3.Change the Save as type to "All Files";

4.Type in the file name: CFScript

5.Click Save ...


  • Referring to the screenshot above, drag CFScript.txt into ComboFix.exe.
  • ComboFix may request an update; please allow it.
  • ComboFix will now run a scan on your system. It may reboot your system when it finishes. This is normal.
  • When finished, it shall produce a log for you.
  • Copy and paste the contents of the log in your next reply.

CAUTION: Do not mouse-click ComboFix's window while it is running. That may cause it to stall.


Please advise how the computer is running now and if there are any outstanding issues

Link to post
Share on other sites

  • Staff

Please run the following:

Visit ADOBE and download the latest version of Acrobat Reader (version XI)

Having the latest updates ensures there are no security vulnerabilities in your system.

Decline any additional installs that may be offered.



Your Java is out of date. Older versions have vulnerabilities that malware can use to infect your system. Please follow these steps to remove older version Java components and update.

  • Download the latest version of Java Runtime Environment (JRE) 7 and Save it to your Desktop.
  • Scroll down to where it says Java SE 7u21
  • Click the Download button under JRE to the right.
  • Read the License Agreement then select Accept License Agreement
  • Click on the link to download Windows x86 Offline and save the file to your desktop.
  • Close any programs you may have running - especially your web browser.
  • Go to Start > Control Panel, double-click on Add or Remove Programs and remove all older versions of Java.
  • Check (highlight) any item with Java Runtime Environment (JRE or J2SE or Java 6) in the name.
  • Click the Remove or Change/Remove button.
  • Repeat as many times as necessary to remove each Java versions.
  • Reboot your computer once all Java components are removed.
  • Then from your desktop double-click on jre-7u21-windows-i586.exe to install the newest version.
  • Decline any additional installs that may be offered.

  • After the install is complete, go into the Control Panel (using Classic View) and double-click the Java Icon. (looks like a coffee cup)
    • On the General tab, under Temporary Internet Files, click the Settings button.
    • Next, click on the Delete Files button
    • There are three options in the window to clear the cache - Leave these two Checked

      • Trace and Log Files
        Cached Applications and Applets

    • Click OK on Delete Temporary Files Window
      Note: This deletes ALL the Downloaded Applications and Applets from the CACHE.
    • Click OK to leave the Temporary Files Window
    • Click OK to leave the Java Control Panel.


Please let me know if there are any outstanding issues

Link to post
Share on other sites

Thanks. I updated to the latest version of the Adobe reader, and de-installed JAVA and reinstalled the latest version. I re-ran a quick scan on MalwareBytes and there were no problems detected. I have no other problems that have occurred or popped up, so I believe I am all set. Thank you very much for all your assistance and guidance. Regards,

Link to post
Share on other sites

  • Staff

We just have some housekeeping to do now,

Please do the following:

You can delete the FRST, JRT and MBAR logs and programs from your desktop.


Follow these steps to uninstall Combofix

  • Make sure your security programs are totally disabled.
  • Press the WinKey +R to open a run box
  • Now copy/paste Combofix /uninstall into the runbox and click OK. Note the space between the ..X and the /U, it needs to be there.



  • Double click on adwcleaner.exe to run the tool.
  • Click on Uninstall.
  • Confirm with yes.

If there are any logs/tools remaining on your desktop > right click and delete them.


Below I have included a number of recommendations for how to protect your computer against malware infections.

  • It is good security practice to change your passwords to all your online accounts on a fairly regular basis, this is especially true after an infection. Refer to this Microsoft article
    Strong passwords: How to create and use them
    Then consider a password keeper, to keep all your passwords safe. KeePass is a small utility that allows you to manage all your passwords.
  • Keep Windows updated by regularly checking their website at :
    This will ensure your computer has always the latest security updates available installed on your computer.
  • Make Internet Explorer more secure
    • Click Start > Run
    • Type Inetcpl.cpl & click OK
    • Click on the Security tab
    • Click Reset all zones to default level
    • Make sure the Internet Zone is selected & Click Custom level
    • In the ActiveX section, set the first two options ("Download signed and unsigned ActiveX controls) to "Prompt", and ("Initialize and Script ActiveX controls not marked as safe") to "Disable".
    • Next Click OK, then Apply button and then OK to exit the Internet Properties page.

    [*]Download TFC to your desktop

    • Close any open windows.
    • Double click the TFC icon to run the program
    • TFC will close all open programs itself in order to run,
    • Click the Start button to begin the process.
    • Allow TFC to run uninterrupted.
    • The program should not take long to finish it's job
    • Once its finished it should automatically reboot your machine,
    • if it doesn't, manually reboot to ensure a complete clean

    It's normal after running TFC cleaner that the PC will be slower to boot the first time.

    [*]WOT, Web of Trust, warns you about risky websites that try to scam visitors, deliver malware or send spam. Protect your computer against online threats by using WOT as your front-line layer of protection when browsing or searching in unfamiliar territory. WOT's color-coded icons show you ratings for 21 million websites, helping you avoid the dangerous sites:

    • Green to go
    • Yellow for caution
    • Red to stop

    WOT has an addon available for both Firefox and IE

    [*]Keep a backup of your important files - Now, more than ever, it's especially important to protect your digital files and memories. This article is full of good information on alternatives for home backup solutions.

    [*]In light of your recent issue, I'm sure you'd like to avoid any future infections. Please take a look at these well written articles:

    PC Safety and Security--What Do I Need?.

    [*]Simple and easy ways to keep your computer safe and secure on the Internet

Thank you for your patience, and performing all of the procedures requested.

Please respond one last time so we can consider the thread resolved and close it, thank-you.

Link to post
Share on other sites

OK, thanks...I deleted the FRST, JRT and MBAR logs and programs from my desktop and uninstalled Combofix.  I uninstalled adwcleaner.  I followed the instructions on setting IE properties.  I downloaded/ran TFC.  I'll read through the other info/material you have recommended. Thanks for all the help!  Regards,

Link to post
Share on other sites

This topic is now closed to further replies.
  • Recently Browsing   0 members

    • No registered users viewing this page.
Back to top
  • Create New...

Important Information

This site uses cookies - We have placed cookies on your device to help make this website better. You can adjust your cookie settings, otherwise we'll assume you're okay to continue.