Jump to content

Infected with persistent wchelper.dll please help

Wobbie

By Wobbie
in Resolved Malware Removal Logs

 Share

Recommended Posts

MrCharlie

MrCharlie

Posted
Posted

Welcome to the forum.

Please run a Quick Scan with Malwarebytes like this and post the log:

Open up Malwarebytes > Settings Tab > Scanner Settings > Under action for PUP > Select: Show in Results List and Check for removal.

Please Update and run a Quick Scan with Malwarebytes Anti-Malware, post the report.

Make sure that everything is checked, and click Remove Selected.

---------------------

Then........

Please download and run RogueKiller 32 Bit to your desktop.

RogueKiller 64 Bit <---use this one for 64 bit systems

Which system am I using?

Quit all running programs.

For Windows XP, double-click to start.

For Vista or Windows 7-8, do a right-click on the program, select Run as Administrator to start, & when prompted Allow to run.

Click Scan to scan the system.

When the scan completes > Close out the program > Don't Fix anything!

Don't run any other options, they're not all bad!!!!!!!

Post back the report which should be located on your desktop.

(please don't put logs in code or quotes and use the default font)

General Forum P2P/Piracy Warning:

MrC

Note:

Please read all of my instructions completely including these.

Make sure system restore is turned on and running, please create a new restore point

Make sure you're subscribed to this topic: Click on the Follow This Topic Button (at the top right of this page), make sure that the Receive notification box is checked and that it is set to Instantly

Removing malware can be unpredictable...unlikely but things can go very wrong! Backup any files that cannot be replaced. You can copy them to a CD/DVD, external drive or a pen drive

<+>Please don't run any other scans, download, install or uninstall any programs while I'm working with you.

<+>The removal of malware isn't instantaneous, please be patient.

<+>When we are done, I'll give to instructions on how to cleanup all the tools and logs

<+>Please stick with me until I give you the "all clear" and Please don't waste my time by leaving before that.

------->Your topic will be closed if you haven't replied within 3 days!<--------

(If I don't respond within 24 hours, please send me a PM)

Link to post
Share on other sites
Wobbie

Wobbie

Posted
  • Author
Posted

G'day MrC,

 

Thanks for your reply, due to other appointments I was unable to check my email yesterday. I hope that's not a problem.

Attached are the logs you asked for.

 

I've used the Malware scanner several times now, every time it finds this same trojan, removes it and the next time I start my computer it's there again.

 

MBAM-log-2014-03-23 (10-44-12).txtRKreport0_S_03232014_104743.txt

Link to post
Share on other sites
MrCharlie

MrCharlie

Posted
Posted

Lets run some scans:

Download Malwarebytes Anti-Rootkit from HERE

  • Unzip the contents to a folder in a convenient location.
  • Open the folder where the contents were unzipped and run mbar.exe
  • Follow the instructions in the wizard to update and allow the program to scan your computer for threats.
  • Click on the Cleanup button to remove any threats and reboot if prompted to do so.
  • Wait while the system shuts down and the cleanup process is performed.
  • Perform another scan with Malwarebytes Anti-Rootkit to verify that no threats remain. If they do, then click Cleanup once more and repeat the process.
  • When done, please post the two logs produced they will be in the MBAR folder..... mbar-log.txt and system-log.txt
To attach a log if needed:

Bottom right corner of this page.

reply1.jpg

New window that comes up.

replyer1.jpg

-----------------------------------------------

Next:

Please download and run ComboFix.

http://www.bleepingcomputer.com/download/combofix/dl/12/ <---direct download

The most important things to remember when running it is to disable all your malware programs and run Combofix from your desktop.

Please visit this webpage for download links, and instructions for running ComboFix

http://www.bleepingcomputer.com/combofix/how-to-use-combofix

Please make sure you click download buttons that look similar to this, not "sponsored ad links":

bleep-crop.jpg

Ensure you have disabled all anti virus and anti malware programs so they do not interfere with the running of ComboFix.

Information on disabling your malware programs can be found Here.

Make sure you run ComboFix from your desktop.

Give it at least 30-45 minutes to finish if needed.

Please include the C:\ComboFix.txt in your next reply for further review.

 

---------->NOTE<----------

If you get the message Illegal operation attempted on registry key that has been marked for deletion after you run ComboFix....please reboot the computer, this should resolve the problem. You may have to do this several times if needed.

MrC

Link to post
Share on other sites
MrCharlie

MrCharlie

Posted
Posted

Please run a free online scan with the ESET Online Scanner (it may take a while to run)

Note: You will need to use Internet Explorer for this scan.

First please Disable any Antivirus you have active, as shown in This Topic

Note: Don't forget to re-enable it after the scan.

http://www.eset.eu/online-scanner

Tick the box next to YES, I accept the Terms of Use.

Click Start

When asked, allow the ActiveX control to install

Click Start

Make sure that the options Remove found threats is unchecked and the option Scan unwanted applications is checked

Click Advanced settings and select the following:

  • Scan potentially unwanted applications
  • Scan for potentially unsafe applications
  • Enable Anti-Stealth technology
Click Start

Wait for the scan to finish

If threats were found:

Click on "list of threats found"

Click on "export to text file" and save it as ESET SCAN and save to the desktop

Click on back

Put a checkmark in "Uninstall application on close"

Click on finish

Post back the log.....MrC

Link to post
Share on other sites
MrCharlie

MrCharlie

Posted
Posted

You have plenty of keygens and cracks on the system, no wonder you're infected.

 

These are OK:

C:\Documents and Settings\Beheerder\Application Data\Mozilla\Firefox\Profiles\7qexahw3.default\prefs.js JS/SecurityDisabler.A.Gen potentially unwanted application
C:\Documents and Settings\Beheerder\Application Data\Mozilla\Firefox\Profiles\7qexahw3.default\prefs.js.BAK JS/SecurityDisabler.A.Gen potentially unwanted application
C:\Documents and Settings\Beheerder\Application Data\Mozilla\Firefox\Profiles\7qexahw3.default\user.js JS/SecurityDisabler.A.Gen potentially unwanted application
C:\Qoobox\Quarantine\D\ntldr.exe.vir a variant of MSIL/Autorun.Agent.DW worm
D:\System Volume Information\_restore{5109EBB4-5A77-45AA-AB80-1E4AC3D643AC}\RP1770\A0219953.exe a variant of MSIL/Autorun.Agent.DW worm
O:\software\Beveiliging\ccsetup408.exe Win32/Bundled.Toolbar.Google.D potentially unsafe application
O:\software\Beveiliging\ccsetup411pro.exe Win32/Bundled.Toolbar.Google.D potentially unsafe application
O:\software\Hulp\ccsetup326.exe Win32/Bundled.Toolbar.Google.D potentially unsafe application

 



I'm not sure what these are, you should know: (The rest can be deleted)

O:\software\Web\WebDesign\Joomla_CMS\Templates\Icetheme\Cinema2 (Joomla 2.5)\Clone_Installer-(Joomla-2.5.0).zip PHP/Obfuscated.F potentially unwanted application
O:\software\Web\WebDesign\Joomla_CMS\Templates\Icetheme\Cinema2 (Joomla 2.5)\tpl_it_cinema2_v.1.7.1.zip PHP/Obfuscated.F potentially unwanted application
O:\software\Web\WebDesign\Joomla_CMS\Templates\Icetheme\Community (Joomla 2.5)\Clone_Installer-(Joomla-2.5.0).zip PHP/Obfuscated.F potentially unwanted application
O:\software\Web\WebDesign\Joomla_CMS\Templates\Icetheme\Community (Joomla 2.5)\tpl_it_community_v.1.7.0.zip PHP/Obfuscated.F potentially unwanted application
O:\software\Web\WebDesign\Joomla_CMS\Templates\Icetheme\Corporate (Joomla 2.5)\Clone_Installer-(Joomla-2.5.1).zip PHP/Obfuscated.F potentially unwanted application
O:\software\Web\WebDesign\Joomla_CMS\Templates\Icetheme\Corporate (Joomla 2.5)\tpl_it_corporate_v.1.7.1.zip PHP/Obfuscated.F potentially unwanted application
O:\software\Web\WebDesign\Joomla_CMS\Templates\Icetheme\Musical (Joomla 2.5)\Clone_Installer-(Joomla-2.5.1).zip PHP/Obfuscated.F potentially unwanted application
O:\software\Web\WebDesign\Joomla_CMS\Templates\Icetheme\Newsy3 (Joomla 2.5)\Clone_Installer-(Joomla-2.5.0).zip PHP/Obfuscated.F potentially unwanted application
O:\software\Web\WebDesign\Joomla_CMS\Templates\Icetheme\Newsy3 (Joomla 2.5)\tpl_it_newsy3_v.1.7.0.zip PHP/Obfuscated.F potentially unwanted application
O:\software\Web\WebDesign\Joomla_CMS\Templates\Icetheme\Portfolio (Joomla 2.5)\Clone_Installer-(Joomla-2.5.1).zip PHP/Obfuscated.F potentially unwanted application
O:\software\Web\WebDesign\Joomla_CMS\Templates\Icetheme\Portfolio (Joomla 2.5)\IT_Portfolio_Template_1.7.0.zip PHP/Obfuscated.F potentially unwanted application
O:\software\Web\WebDesign\Joomla_CMS\Templates\Icetheme\Property (Joomla 2.5)\Clone_Installer-(Joomla-2.5.0).zip PHP/Obfuscated.F potentially unwanted application
O:\software\Web\WebDesign\Joomla_CMS\Templates\Icetheme\Property (Joomla 2.5)\tpl_it_property_v.1.7.0.zip PHP/Obfuscated.F potentially unwanted application
O:\software\Web\WebDesign\Joomla_CMS\Templates\Icetheme\The Lodge 2 (Joomla 2.5)\Clone_Installer-(Joomla-2.5.0).zip PHP/Obfuscated.F potentially unwanted application
O:\software\Web\WebDesign\Joomla_CMS\Templates\Icetheme\The Lodge 2 (Joomla 2.5)\tpl_it_thelodge2.zip PHP/Obfuscated.F potentially unwanted application
O:\software\Web\WebDesign\Joomla_CMS\Templates\Icetheme\Theshop (Joomla 2.5)\Clone_Installer-(Joomla-2.5.0).zip PHP/Obfuscated.F potentially unwanted application
O:\software\Web\WebDesign\Joomla_CMS\Templates\Icetheme\Theshop (Joomla 2.5)\tpl_it_theshop_v.1.7.0.zip PHP/Obfuscated.F potentially unwanted application
O:\software\Web\WebDesign\Joomla_CMS\Templates\Icetheme\TheSoftware 2 (Joomla 2.5)\Clone_Installer-(Joomla-2.5.0).zip PHP/Obfuscated.F potentially unwanted application
O:\software\Web\WebDesign\Joomla_CMS\Templates\Icetheme\TheSoftware 2 (Joomla 2.5)\tpl_it_thesoftware2_v.1.7.0.zip PHP/Obfuscated.F potentially unwanted application
O:\software\Web\WebDesign\Joomla_CMS\Templates\Icetheme\University (Joomla 2.5)\Clone_Installer-(Joomla-2.5.0).zip PHP/Obfuscated.F potentially unwanted application
O:\software\Web\WebDesign\Joomla_CMS\Templates\Icetheme\University (Joomla 2.5)\tpl_it_cinema2_v.1.7.1.zip PHP/Obfuscated.F potentially unwanted application

 

 

Link to post
Share on other sites
Guest
This topic is now closed to further replies.
 Share
Go to topic listing

  • Recently Browsing   0 members

    • No registered users viewing this page.
Back to top
×
×
  • Create New...

Important Information

This site uses cookies - We have placed cookies on your device to help make this website better. You can adjust your cookie settings, otherwise we'll assume you're okay to continue.