Help Multiple Trojans (filename).exe contained a virus and was deleted.

Starstruck106 · June 24, 2013

Unable to download on Windows Vista computer. Gets most of the way through download and then comes back with (filename) .exe contained a virus and was deleted. Virus programs and firewalls are not working properly. Submitted files to HiJack This Support four days ago - no response. Have submitted files to McAffee (response at end) using Susp file tool downloaded to unaffected system and transferred on disk. Susp file program ran in safe mode detected 85 files submitted to McAfee as logs it would not submit as samples but only detected around 4 suspicious files in regular mode.

:huh: First instance of Stinger ran and or the analysis of Suspicious files found the following but did not necessarily Quarantine Trojan/PSW.VKont.bb2; (vrobot) Trojan Win32.Agent.44168; (TrendMicro Home-Call) TROJ_GEN.F47V0816; Artemis!F5CD45497111. Instances of Stinger ran afterward detected nothing. Believe Stinger and other previously clean files now are infected.

Link for HiJack this http://sourceforge.net/p/hjt/support-requests/30/ support request that contains the log files etc. . . .

Have ran the following programs from a clean computer burned disk but had trouble initializing most at first and took several attempts to run them. :wacko:

Trend Micro Anti Threat Toolkit

HiJack This

Get Susp

Rootkit Buster

Stinger32

Rootkit Remover

SuperDAT

7107xdat

removeklez

removebugbear

Unable to run or virus would not allow :angry2:

Mydoomscanner

Nightdragon

McAfee TechCheck

Security Scan

McAfee Setup

Have several directories detected in DOS that I do not recognize from around the time of infection can provide names if necessary.

Response from McAfee: :blink: Thank you for using the GetSusp tool and submitting your suspicious file(s). You will find detailed below, the status of each file in the submission after an initial analysis.

        SR Number               Creation Date                WorkItem ID        Machine Name
        =========               ==============               ===========        ===========
        None specified          6/24/2013 8:45:53 AM         958748             SHEILA-PC

        File Name                           Findings                            Detection                           Type
        ---------                           --------                            ---------                           ----
        appcore.ex_                         clean                               analysed_clean
        appcore.resources.dl_               not_detected                        assumed_clean
        classicstarter.dl_                  clean                               analysed_clean
        assistcustomer.dl_                  clean                               analysed_clean
        audaemon.bi_                        not_detected
        ccme_base.dl_                       clean                               known_clean
        hphc_service.ex_                    clean                               analysed_clean
        libcurl.dl_                         not_detected                        Unknown
        cryptocme2.dl_                      clean                               known_clean
        finderhelper.dl_                    not_detected                        assumed_clean
        kbdstub.ex_                         clean                               known_clean
        hpsysdrv.ex_                        clean                               analysed_clean
        iau_sdk.ex_                         clean                               known_clean
        helperstarter.dl_                   clean                               analysed_clean
        sqlite3.dl_                         clean                               known_clean
        remengine.ex_                       clean                               analysed_clean
        runprofiler.ex_                     clean                               analysed_clean
        regutils.dl_                        clean                               analysed_clean
        ssleay32.dl_                        not_detected                        Unknown
        osd.ex_                             clean                               known_clean
        libeay32.dl_                        not_detected                        Unknown
        libexpatw.dl_                       clean                               known_clean

In the event that the files are not listed as known threats, the submission will be forwarded to a McAfee Labs Researcher for further analysis. You will be contacted by McAfee Labs through email with the results of that analysis.

Support -

Thank you for using the GetSusp tool and submitting your suspicious file(s). You will find detailed below, the status of each file in the submission after an initial analysis.

        SR Number               Creation Date                WorkItem ID        Machine Name
        =========               ==============               ===========        ===========
        None specified          6/24/2013 1:03:41 PM         959871             SHEILA-PC

        File Name                           Findings                            Detection                           Type
        ---------                           --------                            ---------                           ----
        audaemon.bi_                        not_detected                        Unknown

In the event that the files are not listed as known threats, the submission will be forwarded to a McAfee Labs Researcher for further analysis. You will be contacted by McAfee Labs through email with the results of that analysis.

Similar response as follows to all other submissions to the same :angry2:

Thank you for using the GetSusp tool and submitting your suspicious file(s). Upon analysis (details listed below), we found that the submitted zip file contained only the logs generated during the GetSusp scan. The data in the logs will be used for prevalence purposes.

Filename                                              Failure Reason                                                                 Machine Name
========                                              ==============                                                                 ========
gsusp_9FE7B4CB0BD9_061913_172326.zip                  The submitted zip file has no viable samples for analysis                      SHEILA-PC

There will be no further communication with respect to this submission. :wacko:

RootKitBusterDebug20130619_00.log hijackthis.log hijackthis.log hijackthis1.txt hijackthis2.txt hijackthis4.txt

Stinger_22062013_021416.html

STUFF PRINTED FROM ABOVE LINK IF UNABLE TO VIEW

Milestone: v1.0_(example)

Status: open

Owner: nobody

Labels: Trojan/PsW VKont Trojan.Win32.Agent & a.Black TROJ_GEN. (1)

Priority: 5

Updated: 4 days ago

Created: 4 days ago

Creator:Sheila

Private: No

Psychotic · June 24, 2013

Hi there,
my name is Marius and I will be assisting you with your Malware related problems.

Before we move on, please read the following points carefully.

First, read my instructions completely. If there is anything that you do not understand kindly ask before proceeding.
Perform everything in the correct order. Sometimes one step requires the previous one.
If you have any problems while you are follow my instructions, Stop there and tell me the exact nature of your problem.
Do not run any other scans without instruction or Add/ Remove Software unless I tell you to do so. This would change the output of our tools and could be confusing for me.
Post all Logfiles as a reply rather than as an attachment unless I specifically ask you. If you can not post all logfiles in one reply, feel free to use more posts.
If I don't hear from you within 3 days from this initial or any subsequent post, then this thread will be closed.
Stay with me. I will give you some advice about prevention after the cleanup process. Absence of symptoms does not always mean the computer is clean.
My first language is not english. So please do not use slang or idioms. It could be hard for me to read. Thanks for your understanding.

Download DDS and save it to your desktop from here or here or
here.

Disable any script blocker, and then double click dds.scr to run the tool.

When done, DDS will open two (2) logs
DDS.txt
Attach.txt
Save both reports to your desktop.

Please download Gmer from here by clicking on the "Download EXE" Button.

Double click on the randomly named GMER.exe. If asked to allow gmer.sys driver to load, please consent.
If it gives you a warning about rootkit activity and asks if you want to run scan...click on NO.
In the right panel, you will see several boxes that have been checked. Uncheck the following ...
- Sections
- IAT/EAT
- Show All ( should be unchecked by default )
[*]Leave everything else as it is. [*]Close all other running programs as well as your Browser. [*]Click the Scan button & wait for it to finish. [*]Once done click on the Save.. button, and in the File name area, type in "ark.txt" or it will save as a .log file which cannot be uploaded to your post. [*]Save it where you can easily find it, such as your desktop. [*]Please post the content of the ark.txt here.

**Caution**
Rootkit scans often produce false positives. Do NOT take any action on any "<--- ROOKIT" entries

Starstruck106 · June 24, 2013

Your in Germany? I have family in Germany. Only problem I have is I am unable to download to this desktop and when I download to any other desktop and try to run the program by way of disk on this computer the program I am trying to run becomes corrupted.

Psychotic · June 24, 2013

Nice to hear you have family here.

Do you have the vista disk?

Starstruck106 · June 24, 2013

I think I got it and yes I believe I still have the Vista disk

ark.txt

attach.txt

dds.txt

Starstruck106 · June 24, 2013

The last program finished and after I saved teh file my computer shut down and kept returning me to the log in screen and refused to finish loading windows. I am currently in safe mode with networking.

Psychotic · June 25, 2013

OK, I think we have some unwanted visitors here...

Please download Malwarebytes Anti-Rootkit from here Malwarebytes : Malwarebytes Anti-Rootkit and save it to your desktop.

Be sure to print out and follow the instructions provided on that same page.

Caution: This is a beta version so please be sure to read the disclaimer and back up any important data before using.

Double click the mbar.zip file to open it, then 'Extract all files'.
Double click the mbar folder to open it, then double click mbar.exe to start the tool.

Check for Updates, then Scan your system for malware

If malware is found, do NOT press the Cleanup button yet. Click EXIT.

I'd like to see the log first so I can see what it sees. You'll find the log in that mbar folder as MBAR-log-<date and time>***.txt . Please attach that to your next reply.

Starstruck106 · June 26, 2013

Sorry still working on trying to find a way to get a clean download so I can get the program onto my system. Hopefully in the next couple of hours. Thank you.

Psychotic · June 26, 2013

skip that. Do the following instead. If it fails to download, try in safe mode with networking ord download from another computer.

Scan with FRST

To run FRST on Vista and Windows7:

For x32 (x86) bit systems download Farbar Recovery Scan Tool and save it to a flash drive.
For x64 bit systems download Farbar Recovery Scan Tool x64 and save it to a flash drive.

Plug the flashdrive into the infected PC.

Enter System Recovery Options.

To enter System Recovery Options from the Advanced Boot Options:

Restart the computer.
As soon as the BIOS is loaded begin tapping the F8 key until Advanced Boot Options appears.
Use the arrow keys to select the Repair your computer menu item.
Choose your language settings, and then click Next.
Select the operating system you want to repair, and then click Next.
Select your user account an click Next.

To enter System Recovery Options by using Windows installation disc:

Insert the installation disc.
Restart your computer.
If prompted, press any key to start Windows from the installation disc. If your computer is not configured to start from a CD or DVD, check your BIOS settings.
Click Repair your computer.
Choose your language settings, and then click Next.
Select the operating system you want to repair, and then click Next.
Select your user account and click Next.

On the System Recovery Options menu you will get the following options:

Startup Repair
System Restore
Windows Complete PC Restore
Windows Memory Diagnostic Tool
Command Prompt
Select Command Prompt

In the command window:
type in notepad and press Enter.
The notepad opens. Under File menu select Open.
Select "Computer" and find your flash drive letter and close the notepad.
In the command window type e:\frst.exe (for x64 bit version type e:\frst64) and press Enter
Note: Replace letter e with the drive letter of your flash drive.
The tool will start to run.
When the tool opens click Yes to disclaimer.
Press Scan button.

It will make a log (FRST.txt) on the flash drive. Please copy and paste it to your reply.

Starstruck106 · June 28, 2013

I ran the MBar and it came up with Malware but could not save log file. Also, it was unable to update because that required a download which I cannot do. I ran if from the cd to prevent corruption hence unable to save log file. I will copy and/or use the paint program to see if you can get a look at the file prior to running the cleanup. As far as the other program I had tried the system restore previously but it would not work. I will attempt it again if the removal does not work as far as downloads with the MBar.

Starstruck106 · June 28, 2013

Here is the information found when I ran the Malware file found through Virustotal

Copyright

Publisher Music Converter Technologies

Product Music Converter

Version 3.1.0.0

Internal name Installer Internal Name

File version 3.1.0.0

Description Music Converter Installer

 Packers identified

Command UPX

F-PROT UPX

 PE header basic information

Target machine Intel 386 or later processors and compatible processors

Compilation timestamp 1992-06-19 22:22:17

Link date 11:22 PM 6/19/1992

Entry Point 0x0010BBE0

Number of sections 3

 PE sections

NameVirtual addressVirtual sizeRaw sizeEntropyMD5

UPX0 409657753600.00 d41d8cd98f00b204e9800998ecf8427e

UPX1 5816325160965155847.94 693bcc8d68a54de2a48742e4d04e16ad

.rsrc 109772832768317445.42 ee54fd3a7da57f145859fb80d860aecd

 PE imports

[+] KERNEL32.DLL

[+] advapi32.dll

[+] comctl32.dll

[+] gdi32.dll

[+] oleaut32.dll

[+] user32.dll

 Number of PE resources by type

RT_STRING 14

RT_BITMAP 11

RT_GROUP_CURSOR 7

RT_CURSOR 7

RT_RCDATA 5

RT_ICON 4

RT_VERSION 2

RT_DIALOG 1

RT_MANIFEST 1

RT_GROUP_ICON 1

 Number of PE resources by language

NEUTRAL 43

ENGLISH US 10  File identification

MD5 5547b6b76106aa6f0f229bc8be75daf3

SHA1 45feb3259dae661837d7b5db5ed115b181d5a52c

SHA256 ecccf63fad0ba33289b957f20a85629dde7acecd1f2fadb04364bab92b6da52d

ssdeep

12288:LRnLc9WwaJsKS4axSKMR8kbQ/3jeRw70kdjiPb76JMMy:LRLnwaPKMRfbg3jeRM0kVg7GMMy

File size 535.5 KB ( 548352 bytes )

File type Win32 EXE

Magic literal

PE32 executable for MS Windows (GUI) Intel 80386 32-bit

TrID

UPX compressed Win32 Executable (45.1%)

Win32 EXE Yoda's Crypter (39.2%)

Win32 Executable (generic) (6.6%)

Win16/32 Executable Delphi generic (3.0%)

Generic Win/DOS Executable (2.9%)

 VirusTotal metadata

First submission 2013-06-28 10:42:48 UTC ( 34 minutes ago )

Last submission 2013-06-28 10:42:48 UTC ( 34 minutes ago )

File names

MusicConverterSetup.exe

Installer Internal Name

 Advanced heuristic and reputation engines

ClamAV PUA

Possibly Unwanted Application. While not necessarily malicious, the scanned file presents certain characteristics which depending on the user policies and environment may or may not represent a threat. For full details see: http://www.clamav.net/index.php?s=pua〈=en .

Symantec reputation Suspicious.Insight

I used the MBAR to clean it but could not save the log file.

Starstruck106 · June 28, 2013

Condensed report! The following is a condensed report of the behaviour of the file when executed in a controlled environment. The actions and events described were either performed by the file itself or by any other process launched by the executed file or subjected to code injection by the executed file.

 Opened files

C:\DOCUME~1\<USER>~1\LOCALS~1\Temp\000123DD.log (successful)

C:\DOCUME~1\<USER>~1\LOCALS~1\Temp\ish74717\blank.gif (successful)

C:\DOCUME~1\<USER>~1\LOCALS~1\Temp\ish74717\css\buttons.css (successful)

C:\DOCUME~1\<USER>~1\LOCALS~1\Temp\ish74717\css\ie6_main.css (successful)

C:\DOCUME~1\<USER>~1\LOCALS~1\Temp\ish74717\css\main.css (successful)

C:\DOCUME~1\<USER>~1\LOCALS~1\Temp\ish74717\css\sdk-ui\browse.css (successful)

C:\DOCUME~1\<USER>~1\LOCALS~1\Temp\ish74717\css\sdk-ui\button.css (successful)

C:\DOCUME~1\<USER>~1\LOCALS~1\Temp\ish74717\css\sdk-ui\checkbox.css (successful)

C:\DOCUME~1\<USER>~1\LOCALS~1\Temp\ish74717\css\sdk-ui\images\button-bg.png (successful)

C:\DOCUME~1\<USER>~1\LOCALS~1\Temp\ish74717\css\sdk-ui\images\progress-bg.png (successful)

C:\DOCUME~1\<USER>~1\LOCALS~1\Temp\ish74717\css\sdk-ui\progress-bar.css (successful)

C:\DOCUME~1\<USER>~1\LOCALS~1\Temp\ish74717\defaultOffer\offer_code.dat (successful)

C:\DOCUME~1\<USER>~1\LOCALS~1\Temp\ish74717\defaultOffer\offer_html.dat (successful)

C:\DOCUME~1\<USER>~1\LOCALS~1\Temp\ish74717\defaultOffer\US\offer_code.dat (successful)

C:\DOCUME~1\<USER>~1\LOCALS~1\Temp\ish74717\defaultOffer\US\offer_html.dat (successful)

C:\DOCUME~1\<USER>~1\LOCALS~1\Temp\ish74717\images\back-button.png (successful)

C:\DOCUME~1\<USER>~1\LOCALS~1\Temp\ish74717\images\Bg.jpg (successful)

C:\DOCUME~1\<USER>~1\LOCALS~1\Temp\ish74717\images\close_button.png (successful)

C:\DOCUME~1\<USER>~1\LOCALS~1\Temp\ish74717\images\finish-button.png (successful)

C:\DOCUME~1\<USER>~1\LOCALS~1\Temp\ish74717\images\finish_button.jpg (successful)

C:\DOCUME~1\<USER>~1\LOCALS~1\Temp\ish74717\images\icon.png (successful)

C:\DOCUME~1\<USER>~1\LOCALS~1\Temp\ish74717\images\loader.gif (successful)

C:\DOCUME~1\<USER>~1\LOCALS~1\Temp\ish74717\images\next-button-over.png (successful)

C:\DOCUME~1\<USER>~1\LOCALS~1\Temp\ish74717\images\next-button.png (successful)

C:\DOCUME~1\<USER>~1\LOCALS~1\Temp\ish74717\images\progress-bg.png (successful)

C:\DOCUME~1\<USER>~1\LOCALS~1\Temp\ish74717\images\skip-button.png (successful)

C:\DOCUME~1\<USER>~1\LOCALS~1\Temp\ish74717\images\Software.png (successful)

C:\DOCUME~1\<USER>~1\LOCALS~1\Temp\ish74717\license.txt (successful)

C:\DOCUME~1\<USER>~1\LOCALS~1\Temp\ish74717\locale\EN.locale (successful)

\\.\PIPE\lsarpc (successful)

\\.\pipe\1VtP0GtCtTtGtT0M2Y1B1L1RtT0C1F1G2X1P1C2Z1P1CtP1V (failed)

\\.\pipe\1VtP0GtCtTtGtT0M2Y1B1L1RtT0C1F1G2X1P1C2Z1P1CtP1V_TEST (successful)

C:\WINDOWS\Registration\R000000000007.clb (successful)

C:\Program Files\Internet Explorer\iexplore.exe (successful)

\\.\Ip (successful)

C:\WINDOWS\system32\hnetcfg.dll\3 (failed)

C:\WINDOWS\system32\hnetcfg.dll (successful)

C:\WINDOWS\system32\stdole2.tlb (successful)

C:\ecccf63fad0ba33289b957f20a85629dde7acecd1f2fadb04364bab92b6da52d (successful)

C:\WINDOWS\system32\shdocvw.dll (successful)

C:\DOCUME~1\<USER>~1\LOCALS~1\Temp\ish74717\bootstrap_21850.html (successful)

c:\autoexec.bat (successful)

\\.\MountPointManager (successful)

C:\Documents and Settings\<USER>\Local Settings\Temp\ish74717\bootstrap_21850.html (successful)

C:\WINDOWS\WindowsShell.manifest (successful)

C:\Documents and Settings\<USER>\Local Settings\Temp\ish74717\css\sdk-ui\progress-bar.css (successful)

C:\Documents and Settings\<USER>\Local Settings\Temp\ish74717\css\sdk-ui\checkbox.css (successful)

C:\Documents and Settings\<USER>\Local Settings\Temp\ish74717\css\sdk-ui\browse.css (successful)

C:\Documents and Settings\<USER>\Local Settings\Temp\ish74717\css\sdk-ui\button.css (successful)

C:\Documents and Settings\<USER>\Local Settings\Temp\ish74717\css\main.css (successful)

C:\Documents and Settings\<USER>\Local Settings\Temp\ish74717\css\buttons.css (successful)

C:\Documents and Settings\<USER>\Local Settings\Temp\ish74717\css\ie6_main.css (successful)

C:\PROGRA~1\is75168.log (successful)

C:\DOCUME~1\<USER>~1\LOCALS~1\Temp\000125AA.log (successful)

C:\DOCUME~1\<USER>~1\LOCALS~1\Temp\ICReinstall_ecccf63fad0ba33289b957f20a85629dde7acecd1f2fadb04364bab92b6da52d (successful)

\\.\PIPE\srvsvc (successful)

C:\Documents and Settings\<USER>\Local Settings\Temp\ICReinstall_ecccf63fad0ba33289b957f20a85629dde7acecd1f2fadb04364bab92b6da52d (successful)

C:\Documents and Settings\<USER>\Local Settings\Temp\ (successful)

C:\Documents and Settings\<USER>\Desktop\Continue FoxTab Music Converter Installation.lnk (successful)

\\.\PIPE\wkssvc (successful)

C:\ECCCF6~1 (successful)

C:\Documents and Settings\<USER>\Local Settings\Temp\ish74717\images\bg.jpg (successful)

C:\Documents and Settings\<USER>\Local Settings\Temp\ish74717\css\sdk-ui\images\progress-bg.png (successful)

C:\Documents and Settings\<USER>\Local Settings\Application Data\Microsoft\Internet Explorer\MSIMGSIZ.DAT (successful)

C:\Documents and Settings\<USER>\Local Settings\Temp\ish74717\images\loader.gif (successful)

C:\WINDOWS\system32\dxtmsft.dll (successful)

C:\Documents and Settings\<USER>\Local Settings\Temp\ish74717\images\Software.png (successful)

C:\WINDOWS\system32\dxtrans.dll (successful)

C:\Documents and Settings\<USER>\Local Settings\Temp\ish74717\images\next-button.png (successful)

C:\Documents and Settings\<USER>\Local Settings\Temp\ish74717\images\icon.png (successful)

C:\Documents and Settings\<USER>\Local Settings\Temp\ish74717\images\close_button.png (successful)

C:\Documents and Settings\<USER>\Local Settings\Temp\ish74717\images\skip-button.png (successful)

C:\Documents and Settings\<USER>\Local Settings\Temp\ish74717\images\back-button.png (successful)

C:\Documents and Settings\<USER>\Local Settings\Temp\ish74717\images\finish-button.png (successful)

C:\DOCUME~1\<USER>~1\LOCALS~1\Temp\0001264A.log (successful)

C:\DOCUME~1\<USER>~1\LOCALS~1\Temp\is1438683437\131593377.cfg (successful)

C:\DOCUME~1\<USER>~1\LOCALS~1\Temp\is1438683437\1572444273.cfg (successful)

C:\DOCUME~1\<USER>~1\LOCALS~1\Temp\is1438683437\37374_Setup.CIS (successful)

Contract

 Read files