Another Victim of Ad playing Trojan?

[MrCharlie]

Did you run AdwCleaner and MB???

How is it???

MrC

[wireless_one]

just finished running both, AND creating a restore point immediately after.  Seems fine again. Now, going back to your security post fro earlier and going to do that.  On question:  when I open IE, eventually I get a request to make changes to my system with the publisher of the cert being "Microsoft Windows".  I have declined because I'm not sure if those crafty hackers embedded something and are trying to trick me by using Microsoft as the cert holder.  Your thoughts?

[wireless_one]

ok, security results:

 

 Results of screen317's Security Check version 0.99.78  

 Windows 7  x86 (UAC is enabled)  

 Out of date service pack!! 

 Internet Explorer 11  

``````````````Antivirus/Firewall Check:`````````````` 

 Windows Firewall Enabled!  

AVG AntiVirus Free Edition 2014   

 Antivirus up to date!   

`````````Anti-malware/Other Utilities Check:````````` 

 Malwarebytes Anti-Malware version 1.75.0.1300  

 Java 7 Update 45  

 Adobe Reader 10.1.8 Adobe Reader out of Date!  

 Mozilla Firefox (3.6.11) Firefox out of Date!  

 Google Chrome 31.0.1650.57  

 Google Chrome 31.0.1650.63  

````````Process Check: objlist.exe by Laurent````````  

 AVG avgwdsvc.exe 

 AVG avgrsx.exe 

 AVG avgnsx.exe 

 AVG avgemc.exe 

 Malwarebytes' Anti-Malware mbamscheduler.exe   

`````````````````System Health check````````````````` 

 Total Fragmentation on Drive C: 0% 

````````````````````End of Log`````````````````````` 

[MrCharlie]

Out dated programs on the system are vulnerable to malware.
Please update or uninstall them:

~~~~~~~~~~~~~~~~~~~~~~~

Results of screen317's Security Check version 0.99.78
Windows 7 x86 (UAC is enabled)
Out of date service pack!! <--------you're missing a service pack, visit Windows update for this
Internet Explorer 11

------------------------------------------

Java 7 Update 45 <--------this is OK but from your logs you have remnants of older versions.
I suggest you download and run JavaRa.exe to clean them all out, details here:
http://forums.whatthetech.com/index.php?showtopic=68632

---------------------------------------------

Adobe Reader 10.1.8 Adobe Reader out of Date! (big hole in your security) <---please check for an update if available or uninstall and download and install Foxit Reader which is less vulnerable to malware and much better than Adobe. Don't install any toolbars that may come with it (ASK Toolbar).

------------------------------------------

Mozilla Firefox (3.6.11) Firefox out of Date! <----uninstall and download the latest version
http://www.mozilla.org/en-US/firefox/new/

 

Better Yet, uninstall and use Google Chrome:

https://www.google.com/intl/en/chrome/browser/

~~~~~~~~~~~~~~~~~~~~~~~~~

A little clean up to do....

Please Uninstall ComboFix: (if you used it)

Press the Windows logo key + R to bring up the "run box"

Copy and paste next command in the field:

ComboFix /uninstall

Make sure there's a space between Combofix and /



Then hit enter.
This will uninstall Combofix, delete its related folders and files, hide file extensions, hide the system/hidden files and clears System Restore cache and create new Restore point

(If that doesn't work.....you can simply rename ComboFix.exe to Uninstall.exe and double click it to complete the uninstall or download and run the uninstaller)

---------------------------------

Please download OTC to your desktop. (This will clean up most of the tools and logs)
http://oldtimer.geekstogo.com/OTC.exe

Double-click OTC to run it. (Vista and up users, please right click on OTC and select "Run as an Administrator")
Click on the CleanUp! button and follow the prompts.
(If you get a warning from your firewall or other security programs regarding OTC attempting to contact the Internet, please allow the connection.)
You will be asked to reboot the machine to finish the Cleanup process, choose Yes.
After the reboot all the tools we used should be gone.
Note: Some more recently created tools may not yet be removed by OTC. Feel free to manually delete any tools it leaves behind.

Any other programs or logs you can manually delete. (right click.....Delete)
IE: RogueKiller.exe, RKreport.txt, RK_Quarantine folder, C:\FRST folder, FRST-OlderVersion folder, MBAR folder, etc....AdwCleaner > just run the program and click uninstall.

Note:
If you used FRST and can't delete the quarantine folder:
Download the fixlist.txt to the same folder as FRST.exe.
Run FRST.exe and click Fix only once and wait
That will delete the quarantine folder created by FRST.
The rest you can manually delete.

-------------------------------

Any questions...please post back.
If you think I've helped you, please leave a comment > click on my avatar picture > click Profile Feed.

Take a look at My Preventive Maintenance to avoid being infected again.

Good Luck and Thanks for using the forum, MrC

[wireless_one]

ok, no idea what to do, but it's back . . .again . .. I started cleaning up (SP1, etc) and all of a sudden a random reboot AFTER IE appeared to try and an upgrade.  This time I checked the certificate and it stated it was legit, so I said ok to the changes.  it failed, then a few minutes later, system reboot.  after reboot, few minutes later, adds back . . uggggh . . .what is this evil that has found my laptop??? I did a restore point that predates the crash.  Should I try and restore to there? 

[wireless_one]

same issue, different instructions in this thread . . . is this another option?

 

http://www.bleepingcomputer.com/forums/t/520441/hearing-weird-mashup-of-adsmusicnews-zekos/

[MrCharlie]

Delete your copy of RogueKiller and download and run a fresh copy, post the log.

MrC

[wireless_one]

do you only want me to post the log or should I also delete the files it said should be delete? Up to this point, only have posted logs....

[wireless_one]

here is the log . . .RK still open and waiting for direction . . . root.zekos is flashing in red . . .

 

RogueKiller V8.8.1 [Jan 14 2014] by Tigzy

mail : tigzyRK<at>gmail<dot>com

Feedback : http://www.adlice.com/forum/

Website : http://www.adlice.com/softwares/roguekiller/

Blog : http://www.adlice.com

 

Operating System : Windows 7 (6.1.7601 Service Pack 1) 32 bits version

Started in : Normal mode

User : Kevin Barlay [Admin rights]

Mode : Scan -- Date : 01/15/2014 09:44:46

| ARK || FAK || MBR |

 

¤¤¤ Bad processes : 0 ¤¤¤

 

¤¤¤ Registry Entries : 6 ¤¤¤

[RUN][sUSP PATH] HKCU\[...]\Run : QuickTextPasteAndCommand ("C:\Users\Kevin Barlay\Desktop\QuickTextPaste\QuickTextPaste.exe" -bg [-]) -> FOUND

[RUN][sUSP PATH] HKUS\S-1-5-21-3505198377-27462483-240381639-1000\[...]\Run : QuickTextPasteAndCommand ("C:\Users\Kevin Barlay\Desktop\QuickTextPaste\QuickTextPaste.exe" -bg [-]) -> FOUND

[HJ POL][PUM] HKLM\[...]\System : DisableRegistryTools (0) -> FOUND

[HJ SMENU][PUM] HKCU\[...]\Advanced : Start_ShowMyGames (0) -> FOUND

[HJ DESK][PUM] HKLM\[...]\NewStartPanel : {59031a47-3f72-44a7-89c5-5595fe6b30ee} (1) -> FOUND

[HJ DESK][PUM] HKLM\[...]\NewStartPanel : {20D04FE0-3AEA-1069-A2D8-08002B30309D} (1) -> FOUND

 

¤¤¤ Scheduled tasks : 0 ¤¤¤

 

¤¤¤ Startup Entries : 0 ¤¤¤

 

¤¤¤ Web browsers : 0 ¤¤¤

 

¤¤¤ Browser Addons : 0 ¤¤¤

 

¤¤¤ Particular Files / Folders: ¤¤¤

[Root.Zekos][File] rpcss.dll : C:\Windows\System32\rpcss.dll [-] --> FOUND

 

¤¤¤ Driver : [NOT LOADED 0xc0000033] ¤¤¤

 

¤¤¤ External Hives: ¤¤¤

 

¤¤¤ Infection : Root.Zekos ¤¤¤

 

¤¤¤ HOSTS File: ¤¤¤

--> %SystemRoot%\System32\drivers\etc\hosts

 

 

127.0.0.1       localhost

 

 

¤¤¤ MBR Check: ¤¤¤

 

+++++ PhysicalDrive0: (\\.\PHYSICALDRIVE0 @ IDE) WDC WD2500BEKT-75A25T0 +++++

--- User ---

[MBR] 1cb1bd34ff38e4a1d00097acbd6be981

[bSP] 60fc12e9eff6733c42f39fc56b49ce6d : Windows Vista MBR Code

Partition table:

0 - [XXXXXX] DELL-UTIL (0xde) [VISIBLE] Offset (sectors): 63 | Size: 39 Mo

1 - [ACTIVE] NTFS (0x07) [VISIBLE] Offset (sectors): 81920 | Size: 12690 Mo

2 - [XXXXXX] NTFS (0x07) [VISIBLE] Offset (sectors): 26071040 | Size: 225744 Mo

User = LL1 ... OK!

User = LL2 ... OK!

 

Finished : << RKreport[0]_S_01152014_094446.txt >>

[wireless_one]

it seems like we do the same thing each time (replace the infected .dll) but it somehow keeps getting reinfected.  is there another file that we need to delete/replace/modify?

[MrCharlie]

Run RogueKiller again and click Scan

When the scan completes > click on the Files tab

Put a check next to all of these and uncheck the rest: (if found)

 

[Root.Zekos][File] rpcss.dll : C:\Windows\System32\rpcss.dll [-] --> FOUND

Now click Delete on the right hand column under Options

-------------

Post the log.....MrC

[wireless_one]

There's no check box, but can highlight. Is that what you mean?

[wireless_one]

when I hover over delete, it only refers to the registry files that are checked... I'm not given an option to delete, "rpcss.DLL"

[wireless_one]

screens of Rougekiller and options

[MrCharlie]

Please download and run ComboFix.

The most important things to remember when running it is to disable all your malware programs and run Combofix from your desktop.

Please visit this webpage for download links, and instructions for running ComboFix

http://www.bleepingcomputer.com/combofix/how-to-use-combofix

Please make sure you click download buttons that look similar to this, not "sponsored ad links":

Ensure you have disabled all anti virus and anti malware programs so they do not interfere with the running of ComboFix.

Information on disabling your malware programs can be found Here.

Make sure you run ComboFix from your desktop.

Give it at least 30-45 minutes to finish if needed.

Please include the C:\ComboFix.txt in your next reply for further review.

---------->NOTE<----------

If you get the message Illegal operation attempted on registry key that has been marked for deletion after you run ComboFix....please reboot the computer, this should resolve the problem. You may have to do this several times if needed.

MrC

[wireless_one]

What about what I asked about roguekiller?

[MrCharlie]

Just run ComboFix.....MrC

[wireless_one]

log attached

cf.txt

[MrCharlie]

Using ComboFix......

1. Close any open browsers.

2. Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.

3. Download the attached CFScript.txt, place it next to ComboFix.exe

Refering to the picture above, drag CFScript into ComboFix.exe

CAUTION: Do not mouse-click ComboFix while it is running. It may cause it to stall.

After reboot, (in case it asks to reboot)......

Please provide the contents of the ComboFix log (C:\ComboFix.txt) in your next reply.

Then...........

Please download Farbar Recovery Scan Tool and save it to a folder. (use correct version for your system.....Which system am I using?)

Please make sure you click download buttons that look similar to this, not "sponsored ad links":

• Double-click to run it. When the tool opens click Yes to disclaimer.
• Press Scan button.
• It will make a log (FRST.txt) in the same directory the tool is run. Please copy and paste it to your reply.
• The first time the tool is run, it makes also another log (Addition.txt). Please attach it to your reply.

If the logs are large, you can attach them:

To attach a log:

Bottom right corner of this page.

New window that comes up.

MrC

[wireless_one]

logs attached . . thanks for the help!  when we get done with this, can you share what we did different this time which is intended for this not to return?  Thanks!

FRST.txt

ComboFix.txt

[wireless_one]

logs attached . . thanks for the help!  when we get done with this, can you share what we did different this time which is intended for this not to return?  Thanks!

 ohh, no "additions" log was found . . 

[MrCharlie]

You didn't use the correct CFScript.txt:

https://forums.malwarebytes.org/index.php?showtopic=140134&p=778396

MrC

[wireless_one]

re-ran script and FRST . . results attached . still no "addition.txt" file though . . 

FRST.txt

ComboFix.txt

[wireless_one]

adwcleaner log . . 

 

# AdwCleaner v3.017 - Report created 15/01/2014 at 21:12:23

# Updated 12/01/2014 by Xplode

# Operating System : Windows 7 Professional Service Pack 1 (32 bits)

# Username : Kevin Barlay - COM-EX-KB2

# Running from : C:\Users\Kevin Barlay\Desktop\cleanup\adwcleaner.exe

# Option : Clean

 

***** [ Services ] *****

 

 

***** [ Files / Folders ] *****

 

Folder Deleted : C:\Users\Kevin Barlay\AppData\Local\AVG SafeGuard toolbar

File Deleted : C:\Windows\System32\Tasks\NCH Software

 

***** [ Shortcuts ] *****

 

 

***** [ Registry ] *****

 

 

***** [ Browsers ] *****

 

-\\ Internet Explorer v9.0.8112.16526

 

 

-\\ Mozilla Firefox v3.6.11 (en-US)

 

[ File : C:\Users\Kevin Barlay\AppData\Roaming\Mozilla\Firefox\Profiles\una71sz2.default\prefs.js ]

 

 

-\\ Google Chrome v31.0.1650.63

 

[ File : C:\Users\Kevin Barlay\AppData\Local\Google\Chrome\User Data\Default\preferences ]

 

 

*************************

 

AdwCleaner[R0].txt - [6061 octets] - [10/01/2014 08:36:06]

AdwCleaner[R1].txt - [5514 octets] - [14/01/2014 11:37:51]

AdwCleaner[R2].txt - [1301 octets] - [15/01/2014 21:10:39]

AdwCleaner[s0].txt - [6400 octets] - [10/01/2014 08:42:24]

AdwCleaner[s1].txt - [5572 octets] - [14/01/2014 11:41:20]

AdwCleaner[s2].txt - [1228 octets] - [15/01/2014 21:12:23]

 

########## EOF - C:\AdwCleaner\AdwCleaner[s2].txt - [1288 octets] ##########

[wireless_one]

MWB log . . .

 

Malwarebytes Anti-Malware (Trial) 1.75.0.1300

www.malwarebytes.org

 

Database version: v2014.01.16.01

 

Windows 7 Service Pack 1 x86 NTFS

Internet Explorer 9.0.8112.16421

Kevin Barlay :: COM-EX-KB2 [administrator]

 

Protection: Disabled

 

1/16/2014 6:20:25 AM

mbam-log-2014-01-16 (06-20-25).txt

 

Scan type: Quick scan

Scan options enabled: Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken | PUP | PUM

Scan options disabled: P2P

Objects scanned: 263468

Time elapsed: 30 minute(s), 13 second(s)

 

Memory Processes Detected: 0

(No malicious items detected)

 

Memory Modules Detected: 0

(No malicious items detected)

 

Registry Keys Detected: 0

(No malicious items detected)

 

Registry Values Detected: 0

(No malicious items detected)

 

Registry Data Items Detected: 0

(No malicious items detected)

 

Folders Detected: 0

(No malicious items detected)

 

Files Detected: 0

(No malicious items detected)

 

(end)