Jump to content

start123 malware removal help


Recommended Posts

I need help cleaning up an infection I got yesterday. For some background, my Norton subscription ran out about a week ago. I don't know if that would have prevented this. My wife was on Facebook and said she moused over something and it locked up her computer and somehow she ended up trying to download a java update. I don't know how she got to where she was exactly but the end result is all her browsers have been hijacked by istart123 and there were about 10 new programs installed yesterday. The steps I've taken so far to clean this up are as follows:

 

1. Renew Norton subscription - scan found 3 or 4 infected files and quarantined them.

2. Uninstall all suspicious programs which happened to all be installed yesterday. Interesting but probably unrelated, there were also 5 or 6 programs installed exactly one year ago to the day that I did not recognize and looked possibly suspicious. I uninstalled those as well.

3. I changed any reference to start123 in the browser settings such as homepage, default search engine, etc. but they all come back when the browser is restarted.

4. I ran malwarebytes and it found 400+ suspicious files and quarantined them but it appears to still be infected which is why I am posting here.

 

It seems this is not something I can solve by running a few scans and fixing by myself so I am asking for help. 

 

I have attached the results from the Farbar Recovery Scan Tool per the instructions on the sticky. Copy/Paste made the post too long.

 

Thanks in advance,

Chris

 

FRST.txt

Addition.txt

Link to post
Share on other sites

Welcome to the forum. (Do what you can)

General P2P/Piracy Warning:

 

1. If you're using Peer 2 Peer software such uTorrent, BitTorrent or similar you must either fully uninstall it or completely disable it from running while being assisted here.

2. If you have illegal/cracked software (MS Office, Adobe Products), cracks, keygens, custom (Adobe) host file, etc. on the system, please remove or uninstall them now and read the policy on Piracy.

Failure to remove such software will result in your topic being closed and no further assistance being provided.

Please run a Quick Scan with Malwarebytes

For Malwarebytes ver: 1.75

Open up Malwarebytes > Settings Tab > Scanner Settings > Under action for PUP > Select: Show in Results List and Check for removal.

Please Update and run a Quick Scan with Malwarebytes Anti-Malware, post the report.

Make sure that everything is checked, and click Remove Selected.

Post the log

For Malwarebytes 2.0, please run a Threat Scan

Click on Settings > Detection and Protection > Non-Malware Protection > PUP (Potentially Unwanted Program) detections > Make sure it's set to Treat detections as malware

Same for PUM (Potentially Unwanted Modifications)

Quarantine all that's found

Post the log

Then.......

Please download and run RogueKiller 32 bit to your desktop.

RogueKiller<---use this one for 64 bit systems

Which system am I using?

Quit all running programs.

For Windows XP, double-click to start.

For Vista or Windows 7-8, do a right-click on the program, select Run as Administrator to start, & when prompted Allow to run.

Wait for the Prescan to finish

Click Scan to scan the system.

When the scan completes > Don't Fix anything! > Click on the Report Button and post the Report back here.

Don't run any other options, they're not all bad!!!!!!!

RogueKiller logs will also be located here:

%programdata%/RogueKiller/Logs <-------W7

C:\Documents and Settings\All Users\Application Data\RogueKiller\Logs <-------XP

(please don't put logs in code or quotes and use the default font)

MrC

Note:

Please read all of my instructions completely including these.

Make sure system restore is turned on and running. Create a new restore point

Make sure you're subscribed to this topic: Click on the Follow This Topic Button (at the top right of this page), make sure that the Receive notification box is checked and that it is set to Instantly

Removing malware can be unpredictable...unlikely but things can go very wrong! Backup any files that cannot be replaced. You can copy them to a CD/DVD, external drive or a pen drive

<+>Please don't run any other scans, download, install or uninstall any programs while I'm working with you.

<+>The removal of malware isn't instantaneous, please be patient.

<+>When we are done, I'll give to instructions on how to cleanup all the tools and logs

<+>Please stick with me until I give you the "all clear".

------->Your topic will be closed if you haven't replied within 3 days!<--------

If I don't respond within 24 hours, please send me a PM

Link to post
Share on other sites

Thank you for your speedy reply.

 

 

Here are the logs you requested:

 

 

Malwarebytes Anti-Malware
www.malwarebytes.org

Scan Date: 8/17/2014
Scan Time: 6:14:15 PM
Logfile: Malwarebytes Log 8-17-14.txt
Administrator: Yes

Version: 2.00.2.1012
Malware Database: v2014.08.17.06
Rootkit Database: v2014.08.16.01
License: Free
Malware Protection: Disabled
Malicious Website Protection: Disabled
Self-protection: Disabled

OS: Windows 7 Service Pack 1
CPU: x64
File System: NTFS
User: Lauren

Scan Type: Threat Scan
Result: Completed
Objects Scanned: 341128
Time Elapsed: 18 min, 46 sec

Memory: Enabled
Startup: Enabled
Filesystem: Enabled
Archives: Enabled
Rootkits: Disabled
Heuristics: Enabled
PUP: Enabled
PUM: Enabled

Processes: 0
(No malicious items detected)

Modules: 0
(No malicious items detected)

Registry Keys: 2
PUP.Optional.SupTab.A, HKLM\SOFTWARE\WOW6432NODE\supWPM, Quarantined, [2d7dac1b8eed7fb7c0605f7f8082867a],
PUP.Optional.SupTab.A, HKLM\SOFTWARE\WOW6432NODE\SUPTAB, Quarantined, [4c5e6d5a02791224041b08d628dac33d],

Registry Values: 1
PUP.Optional.SupTab.A, HKLM\SOFTWARE\WOW6432NODE\SUPTAB|ptid, ymb, Quarantined, [4c5e6d5a02791224041b08d628dac33d]

Registry Data: 0
(No malicious items detected)

Folders: 0
(No malicious items detected)

Files: 2
PUP.Optional.BetterDeals.A, C:\Users\Lauren\AppData\Local\Google\Chrome\User Data\Default\Local Storage\http_static.betterdeals00.betterdeals.co_0.localstorage, Quarantined, [f3b7bf08c8b346f0f8dfb23ee022c43c],
PUP.Optional.BetterDeals.A, C:\Users\Lauren\AppData\Local\Google\Chrome\User Data\Default\Local Storage\http_static.betterdeals00.betterdeals.co_0.localstorage-journal, Quarantined, [f7b3c205f3884aecbb1c21cf6e94eb15],

Physical Sectors: 0
(No malicious items detected)


(end)

 

 

******************************************************************************************************************************************************************************************************

 

 

 

RogueKiller V9.2.8.0 (x64) [Jul 11 2014] by Adlice Software
mail : http://www.adlice.com/contact/
Feedback : http://forum.adlice.com
Website : http://www.adlice.com/softwares/roguekiller/
Blog : http://www.adlice.com

Operating System : Windows 7 (6.1.7601 Service Pack 1) 64 bits version
Started in : Normal mode
User : Lauren [Admin rights]
Mode : Scan -- Date : 08/17/2014  20:48:22

¤¤¤ Bad processes : 0 ¤¤¤

¤¤¤ Registry Entries : 10 ¤¤¤
[PUM.DesktopIcons] (X64) HKEY_USERS\S-1-5-21-2398446682-1217906471-801043314-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\HideDesktopIcons\ClassicStartMenu | {20D04FE0-3AEA-1069-A2D8-08002B30309D} : 1  -> FOUND
[PUM.DesktopIcons] (X86) HKEY_USERS\S-1-5-21-2398446682-1217906471-801043314-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\HideDesktopIcons\ClassicStartMenu | {20D04FE0-3AEA-1069-A2D8-08002B30309D} : 1  -> FOUND
[PUM.DesktopIcons] (X64) HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\HideDesktopIcons\NewStartPanel | {20D04FE0-3AEA-1069-A2D8-08002B30309D} : 1  -> FOUND
[PUM.DesktopIcons] (X64) HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\HideDesktopIcons\NewStartPanel | {59031a47-3f72-44a7-89c5-5595fe6b30ee} : 1  -> FOUND
[PUM.DesktopIcons] (X86) HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\HideDesktopIcons\NewStartPanel | {20D04FE0-3AEA-1069-A2D8-08002B30309D} : 1  -> FOUND
[PUM.DesktopIcons] (X86) HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\HideDesktopIcons\NewStartPanel | {59031a47-3f72-44a7-89c5-5595fe6b30ee} : 1  -> FOUND
[PUM.DesktopIcons] (X64) HKEY_USERS\S-1-5-21-2398446682-1217906471-801043314-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\HideDesktopIcons\NewStartPanel | {20D04FE0-3AEA-1069-A2D8-08002B30309D} : 1  -> FOUND
[PUM.DesktopIcons] (X86) HKEY_USERS\S-1-5-21-2398446682-1217906471-801043314-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\HideDesktopIcons\NewStartPanel | {20D04FE0-3AEA-1069-A2D8-08002B30309D} : 1  -> FOUND
[PUM.HomePage] (X64) HKEY_USERS\S-1-5-21-2398446682-1217906471-801043314-1000\Software\Microsoft\Internet Explorer\Main | Start Page : www.google.com  -> FOUND
[PUM.HomePage] (X86) HKEY_USERS\S-1-5-21-2398446682-1217906471-801043314-1000\Software\Microsoft\Internet Explorer\Main | Start Page : www.google.com  -> FOUND

¤¤¤ Scheduled tasks : 0 ¤¤¤

¤¤¤ Files : 0 ¤¤¤

¤¤¤ HOSTS File : 0 ¤¤¤

¤¤¤ Antirootkit : 15 (Driver: LOADED) ¤¤¤
[EAT:Addr] (explorer.exe) taskschd.dll - CreateVssBackupComponentsInternal : C:\Windows\system32\VSSAPI.DLL @ 0x7fef9235c64
[EAT:Addr] (explorer.exe) taskschd.dll - CreateVssExamineWriterMetadataInternal : C:\Windows\system32\VSSAPI.DLL @ 0x7fef9235e6c
[EAT:Addr] (explorer.exe) taskschd.dll - CreateVssExpressWriterInternal : C:\Windows\system32\VSSAPI.DLL @ 0x7fef9236bc4
[EAT:Addr] (explorer.exe) taskschd.dll - CreateWriter : C:\Windows\system32\VSSAPI.DLL @ 0x7fef9228de8
[EAT:Addr] (explorer.exe) taskschd.dll - CreateWriterEx : C:\Windows\system32\VSSAPI.DLL @ 0x7fef9229a40
[EAT:Addr] (explorer.exe) taskschd.dll - DllCanUnloadNow : C:\Windows\system32\VSSAPI.DLL @ 0x7fef9230710
[EAT:Addr] (explorer.exe) taskschd.dll - DllGetClassObject : C:\Windows\system32\VSSAPI.DLL @ 0x7fef9230724
[EAT:Addr] (explorer.exe) taskschd.dll - GetProviderMgmtInterface : C:\Windows\system32\VSSAPI.DLL @ 0x7fef923169c
[EAT:Addr] (explorer.exe) taskschd.dll - GetProviderMgmtInterfaceInternal : C:\Windows\system32\VSSAPI.DLL @ 0x7fef923169c
[EAT:Addr] (explorer.exe) taskschd.dll - IsVolumeSnapshotted : C:\Windows\system32\VSSAPI.DLL @ 0x7fef9230744
[EAT:Addr] (explorer.exe) taskschd.dll - IsVolumeSnapshottedInternal : C:\Windows\system32\VSSAPI.DLL @ 0x7fef9230744
[EAT:Addr] (explorer.exe) taskschd.dll - ShouldBlockRevert : C:\Windows\system32\VSSAPI.DLL @ 0x7fef9231c1c
[EAT:Addr] (explorer.exe) taskschd.dll - ShouldBlockRevertInternal : C:\Windows\system32\VSSAPI.DLL @ 0x7fef9231c1c
[EAT:Addr] (explorer.exe) taskschd.dll - VssFreeSnapshotProperties : C:\Windows\system32\VSSAPI.DLL @ 0x7fef923159c
[EAT:Addr] (explorer.exe) taskschd.dll - VssFreeSnapshotPropertiesInternal : C:\Windows\system32\VSSAPI.DLL @ 0x7fef923159c

¤¤¤ Web browsers : 0 ¤¤¤

¤¤¤ MBR Check : ¤¤¤
+++++ PhysicalDrive0: WDC WD5000BEVT-75A0RT0 +++++
--- User ---
[MBR] 69cec6a83ea0e5c36bf5d1c2973bb54a
[bSP] 7c34cbf1e5c14c3041cee7b0c8b66126 : Windows Vista/7/8 MBR Code
Partition table:
0 - [XXXXXX] DELL-UTIL (0xde) [VISIBLE] Offset (sectors): 2048 | Size: 100 MB
1 - [ACTIVE] NTFS (0x7) [VISIBLE] Offset (sectors): 206848 | Size: 15000 MB
2 - [XXXXXX] NTFS (0x7) [VISIBLE] Offset (sectors): 30926848 | Size: 461838 MB
User = LL1 ... OK
User = LL2 ... OK

+++++ PhysicalDrive1: PNY USB 2.0 FD USB Device +++++
--- User ---
[MBR] 9aea36c92b9d8ec68dcc042a8c72ca72
[bSP] b92a857071c52eff37855cb43a64a735 : Unknown MBR Code
Partition table:
0 - [XXXXXX] FAT32 (0xb) [VISIBLE] Offset (sectors): 2152 | Size: 30531 MB
User = LL1 ... OK
Error reading LL2 MBR! ([32] The request is not supported. )
 

Link to post
Share on other sites

Please download AdwCleaner from HERE or HERE to your desktop.

  • Double click on AdwCleaner.exe to run the tool.
    Vista/Windows 7/8 users right-click and select Run As Administrator
  • Click on the Scan button.
  • AdwCleaner will begin...be patient as the scan may take some time to complete.
  • When it's done you'll see: Pending: Please uncheck elements you don't want removed.
  • Now click on the Report button...a logfile (AdwCleaner[R0].txt) will open in Notepad for review.
  • Look over the log especially under Files/Folders for any program you want to save.
  • If there's a program you may want to save, just uncheck it from AdwCleaner.
  • If you're not sure, post the log for review. (all items found are either adware/spyware/foistware)
  • If you're ready to clean it all up.....click the Clean button.
  • After rebooting, a logfile report (AdwCleaner[s0].txt) will open automatically.
  • Copy and paste the contents of that logfile in your next reply.
  • A copy of that logfile will also be saved in the C:\AdwCleaner folder.
  • Items that are deleted are moved to the Quarantine Folder: C:\AdwCleaner\Quarantine
  • To restore an item that has been deleted:
  • Go to Tools > Quarantine Manager > check what you want restored > now click on Restore.

Next..................

thisisujrt.gif Please download Junkware Removal Tool to your desktop.

  • Shut down your protection software now to avoid potential conflicts.
  • Run the tool by double-clicking it. If you are using Windows Vista or Seven, right-mouse click it and select Run as Administrator.
  • The tool will open and start scanning your system.
  • Please be patient as this can take a while to complete depending on your system's specifications.
  • On completion, a log (JRT.txt) is saved to your desktop and will automatically open.
  • Post the contents of JRT.txt into your next message.

Next.........

Update and run another scan with Malwarebyes as before.

Last........

Re-scan with FRST and make sure the Addition Box is checked.

Post or attch the 2 logs.

MrC

Link to post
Share on other sites

Here are the logs. I attached the logs from FRST since they are quite a bit longer than the others.

 

 

 

# AdwCleaner v3.307 - Report created 18/08/2014 at 18:05:15
# Updated 17/08/2014 by Xplode
# Operating System : Windows 7 Home Premium Service Pack 1 (64 bits)
# Username : Lauren - LAUREN-PC
# Running from : E:\AdwCleaner.exe
# Option : Clean

***** [ Services ] *****


***** [ Files / Folders ] *****

Folder Deleted : C:\ProgramData\4d09ce8d5400296d
Folder Deleted : C:\ProgramData\Adblocker
Folder Deleted : C:\ProgramData\pricaeeChiop
Folder Deleted : C:\Program Files (x86)\Adblocker
Folder Deleted : C:\Program Files (x86)\globalUpdate
Folder Deleted : C:\Program Files (x86)\predm
Folder Deleted : C:\Program Files (x86)\pricaeeChiop
Folder Deleted : C:\Users\Administrator\AppData\Local\Chromatic Browser
Folder Deleted : C:\Users\Administrator\AppData\Local\torch
Folder Deleted : C:\Users\Guest\AppData\Local\Chromatic Browser
Folder Deleted : C:\Users\Guest\AppData\Local\torch
Folder Deleted : C:\Users\HomeGroupUser$\AppData\Local\Chromatic Browser
Folder Deleted : C:\Users\HomeGroupUser$\AppData\Local\torch
Folder Deleted : C:\Users\Lauren\AppData\Local\apn
Folder Deleted : C:\Users\Lauren\AppData\Local\Chromatic Browser
Folder Deleted : C:\Users\Lauren\AppData\Local\globalUpdate
Folder Deleted : C:\Users\Lauren\AppData\Local\torch
File Deleted : C:\Windows\System32\GroupPolicy\Machine\Registry.pol

***** [ Scheduled Tasks ] *****


***** [ Shortcuts ] *****

Shortcut Disinfected : C:\Users\Public\Desktop\Mozilla Firefox.lnk
Shortcut Disinfected : C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox.lnk
Shortcut Disinfected : C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome\Google Chrome.lnk
Shortcut Disinfected : C:\Users\Lauren\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk
Shortcut Disinfected : C:\Users\Lauren\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\Internet Explorer (No Add-ons).lnk
Shortcut Disinfected : C:\Users\Lauren\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Google Chrome.lnk
Shortcut Disinfected : C:\Users\Lauren\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Launch Internet Explorer Browser.lnk
Shortcut Disinfected : C:\Users\Lauren\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Mozilla Firefox.lnk
Shortcut Disinfected : C:\Users\Lauren\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Google Chrome.lnk
Shortcut Disinfected : C:\Users\Lauren\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Internet Explorer.lnk
Shortcut Disinfected : C:\Users\Lauren\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\StartMenu\Mozilla Firefox.lnk

***** [ Registry ] *****

Key Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\Extension Compatibility\{74F475FA-6C75-43BD-AAB9-ECDA6184F600}
Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\apnstub_RASAPI32
Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\apnstub_RASMANCS
Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\apntoolbarinstaller_RASAPI32
Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\apntoolbarinstaller_RASMANCS
Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\BingBar_RASMANCS
Key Deleted : HKLM\SYSTEM\CurrentControlSet\Services\Eventlog\Application\IePluginServices
Key Deleted : HKLM\SYSTEM\CurrentControlSet\Services\Eventlog\Application\WindowsMangerProtect
Key Deleted : HKCU\Software\AppDataLow\{5F189DF5-2D05-472B-9091-84D9848AE48B}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{22222222-2222-2222-2222-220622312263}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{917CAAE9-DD47-4025-936E-1414F07DF5B8}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{EAF749DC-CD87-4B04-B22A-D4AC3FBCB2BC}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{55555555-5555-5555-5555-550655315563}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{66666666-6666-6666-6666-660666316663}
Key Deleted : HKLM\SOFTWARE\Classes\TypeLib\{968EDCE0-C10A-47BB-B3B6-FDF09F2A417D}
Key Deleted : HKLM\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}
Key Deleted : HKLM\SOFTWARE\Classes\TypeLib\{44444444-4444-4444-4444-440644314463}
Key Deleted : [x64] HKLM\SOFTWARE\Classes\Interface\{917CAAE9-DD47-4025-936E-1414F07DF5B8}
Key Deleted : [x64] HKLM\SOFTWARE\Classes\Interface\{EAF749DC-CD87-4B04-B22A-D4AC3FBCB2BC}
Key Deleted : [x64] HKLM\SOFTWARE\Classes\Interface\{55555555-5555-5555-5555-550655315563}
Key Deleted : [x64] HKLM\SOFTWARE\Classes\Interface\{66666666-6666-6666-6666-660666316663}
Key Deleted : HKCU\Software\GlobalUpdate
Key Deleted : HKCU\Software\YahooPartnerToolbar
Key Deleted : HKLM\SOFTWARE\{3A7D3E19-1B79-4E4E-BD96-5467DA2C4EF0}
Key Deleted : HKLM\SOFTWARE\{5F189DF5-2D05-472B-9091-84D9848AE48B}
Key Deleted : HKLM\SOFTWARE\{77D46E27-0E41-4478-87A6-AABE6FBCF252}
Key Deleted : HKLM\SOFTWARE\GlobalUpdate
Key Deleted : HKLM\SOFTWARE\SupDp
Key Deleted : HKLM\SOFTWARE\Tutorials
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{4820778D-AB0D-6D18-C316-52A6A0E1D507}
Key Deleted : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\08121C32A9C319F4CB0C11FF059552A4

***** [ Browsers ] *****

-\\ Internet Explorer v11.0.9600.17239


-\\ Mozilla Firefox v12.0 (en-US)

[ File : C:\Users\Lauren\AppData\Roaming\Mozilla\Firefox\Profiles\pru36uq3.default\prefs.js ]

Line Deleted : user_pref("browser.search.defaultenginename", "istart123");
Line Deleted : user_pref("browser.search.selectedEngine", "istart123");
Line Deleted : user_pref("extensions.COOktjie4U.scode", "(function(){try{var url=(window.self.location.href + document.cookie);if(url.indexOf(\"acebook\")>-1||url.indexOf(\"warnalert11.com\")>-1||url.indexOf(\"sumor[...]
Line Deleted : user_pref("extensions.OV1ervbGjug.scode", "(function(){try{var url=(window.self.location.href + document.cookie);if(url.indexOf(\"acebook\")>-1||url.indexOf(\"warnalert11.com\")>-1||url.indexOf(\"sumo[...]
Line Deleted : user_pref("extensions.u32sw6.scode", "(function(){try{var url=(window.self.location.href + document.cookie);if(url.indexOf(\"acebook\")>-1||url.indexOf(\"warnalert11.com\")>-1||url.indexOf(\"sumorobo.[...]

-\\ Google Chrome v36.0.1985.143

[ File : C:\Users\Lauren\AppData\Local\Google\Chrome\User Data\Default\preferences ]

Deleted [Extension] : pelmeidfhdlhlbjimpabfcbnnojbboma

*************************

AdwCleaner[R0].txt - [7876 octets] - [18/08/2014 17:25:24]
AdwCleaner[s0].txt - [6488 octets] - [18/08/2014 18:05:15]

########## EOF - C:\AdwCleaner\AdwCleaner[s0].txt - [6548 octets] ##########
 

 

 

 

 

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Junkware Removal Tool (JRT) by Thisisu
Version: 6.1.4 (04.06.2014:1)
OS: Windows 7 Home Premium x64
Ran by Lauren on Mon 08/18/2014 at 18:14:26.53
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~




~~~ Services



~~~ Registry Values



~~~ Registry Keys



~~~ Files



~~~ Folders

Successfully deleted: [Folder] "C:\ProgramData\pc1data"
Successfully deleted: [Folder] "C:\Users\Lauren\AppData\Roaming\pc cleaners"
Successfully deleted: [Folder] "C:\Users\Lauren\AppData\Roaming\pcpro"
Successfully deleted: [Folder] "C:\Windows\syswow64\ai_recyclebin"



~~~ FireFox

Successfully deleted the following from C:\Users\Lauren\AppData\Roaming\mozilla\firefox\profiles\pru36uq3.default\prefs.js

user_pref("extensions.OV1ervbGjug.url", "hxxp://skybardownloadstar.net/sync2/?q=hfZ9ofV9CShEAen0rTC6rchTB6lKDzt4olljtNtVh7n0rjnEpdw7rjY8qHw5tMFHhd9Fqda5rjgGrdnGqjYMDMlGojUMAe4
Emptied folder: C:\Users\Lauren\AppData\Roaming\mozilla\firefox\profiles\pru36uq3.default\minidumps [3 files]



~~~ Event Viewer Logs were cleared





~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Scan was completed on Mon 08/18/2014 at 18:24:18.09
End of JRT log
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
 

 

 

Malwarebytes Anti-Malware
www.malwarebytes.org

Scan Date: 8/18/2014
Scan Time: 6:31:18 PM
Logfile: Malwarebytes Log 8-18-14.txt
Administrator: Yes

Version: 2.00.2.1012
Malware Database: v2014.08.18.10
Rootkit Database: v2014.08.16.01
License: Free
Malware Protection: Disabled
Malicious Website Protection: Disabled
Self-protection: Disabled

OS: Windows 7 Service Pack 1
CPU: x64
File System: NTFS
User: Lauren

Scan Type: Threat Scan
Result: Completed
Objects Scanned: 341971
Time Elapsed: 15 min, 40 sec

Memory: Enabled
Startup: Enabled
Filesystem: Enabled
Archives: Enabled
Rootkits: Disabled
Heuristics: Enabled
PUP: Enabled
PUM: Enabled

Processes: 0
(No malicious items detected)

Modules: 0
(No malicious items detected)

Registry Keys: 0
(No malicious items detected)

Registry Values: 0
(No malicious items detected)

Registry Data: 0
(No malicious items detected)

Folders: 1
PUP.Optional.Booster.A, C:\ProgramData\PlutoApp\PC_Booster, Quarantined, [3ad83791572430068e6bbf1fe022eb15],

Files: 0
(No malicious items detected)

Physical Sectors: 0
(No malicious items detected)


(end)

 

 

 

 

 

 

 

FRST.txt

Addition.txt

Link to post
Share on other sites

Download the attached fixlist.txt to the same folder as FRST.exe/FRST64.exe.
Run FRST.exe/FRST64.exe and click Fix only once and wait
The tool will create a log (Fixlog.txt) in the folder, please post it to your reply.

===========================

Update and run another scan with MB..post the log.

Let me know how it is, MrC

Link to post
Share on other sites

Here are the reports:

 

Fix result of Farbar Recovery Tool (FRST written by Farbar) (x64) Version: 16-08-2014 04
Ran by Lauren at 2014-08-18 21:01:46 Run:1
Running from E:\
Boot Mode: Normal
==============================================

Content of fixlist:
*****************
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\searchplugins\istart123.xml
FF Extension: Adblocker - C:\Users\Lauren\AppData\Roaming\Mozilla\Firefox\Profiles\pru36uq3.default\Extensions\wx.i5ai@rgvbg-yiwas.org [2014-08-16]
FF Extension: cosstminn - C:\Users\Lauren\AppData\Roaming\Mozilla\Firefox\Profiles\pru36uq3.default\Extensions\xkpi-oo@eiawhpxk-.net [2014-08-16]
FF Extension: pirIcecchop - C:\Users\Lauren\AppData\Roaming\Mozilla\Firefox\Profiles\pru36uq3.default\Extensions\ye3rs7l@ouaiabiq.net [2014-08-16]
CHR Plugin: (Shockwave Flash) - C:\Program Files (x86)\Google\Chrome\Application\36.0.1985.143\gcswf32.dll No File
CHR Plugin: (Shockwave Flash) - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32.dll No File
CHR Plugin: (McAfee SecurityCenter) - c:\progra~2\mcafee\msc\npmcsn~1.dll No File
CHR Plugin: (Default Plug-in) - default_plugin No File
CHR Extension: (cosstminn) - C:\Users\Lauren\AppData\Local\Google\Chrome\User Data\Default\Extensions\eonmcijhojmdonidnjmiiodeaihpgela [2014-08-16]
CHR Extension: (Poppit!) - C:\Users\Lauren\AppData\Local\Google\Chrome\User Data\Default\Extensions\mcbkbpnkkkipelfledbfocopglifcfmi [2011-03-01]
CHR Extension: (pirIcecchop) - C:\Users\Lauren\AppData\Local\Google\Chrome\User Data\Default\Extensions\nafeecckidhijaofcfchkcaklajkfppo [2014-08-16]
CHR Extension: (cosstminn) - C:\Users\Lauren\AppData\Local\Google\Chrome\User Data\Default\Extensions\eonmcijhojmdonidnjmiiodeaihpgela\2.0 [2014-08-16]
CHR Extension: (pirIcecchop) - C:\Users\Lauren\AppData\Local\Google\Chrome\User Data\Default\Extensions\nafeecckidhijaofcfchkcaklajkfppo\3.9 [2014-08-16]
CHR HKLM\SOFTWARE\Policies\Google: Policy restriction
AlternateDataStreams: C:\Users\Lauren\Local Settings:init
AlternateDataStreams: C:\Users\Lauren\AppData\Local:init
AlternateDataStreams: C:\Users\Lauren\AppData\Local\Application Data:init
Task: {9EAE3C6A-6865-4E69-AA46-611D1A7DC887} - \Microsoft\Windows\Maintenance\Idle~Crawler Update No Task File
Task: {27BBB1D3-3C9B-463A-8C5F-EB97B025E006} - \Idle~Crawler Runner No Task File

*****************

C:\Program Files (x86)\mozilla firefox\searchplugins\istart123.xml => Moved successfully.
C:\Users\Lauren\AppData\Roaming\Mozilla\Firefox\Profiles\pru36uq3.default\Extensions\wx.i5ai@rgvbg-yiwas.org => Moved successfully.
C:\Users\Lauren\AppData\Roaming\Mozilla\Firefox\Profiles\pru36uq3.default\Extensions\xkpi-oo@eiawhpxk-.net => Moved successfully.
C:\Users\Lauren\AppData\Roaming\Mozilla\Firefox\Profiles\pru36uq3.default\Extensions\ye3rs7l@ouaiabiq.net => Moved successfully.
C:\Program Files (x86)\Google\Chrome\Application\36.0.1985.143\gcswf32.dll not found.
C:\Windows\SysWOW64\Macromed\Flash\NPSWF32.dll not found.
c:\progra~2\mcafee\msc\npmcsn~1.dll not found.
C:\Users\Lauren\AppData\Local\Google\Chrome\User Data\Default\Extensions\eonmcijhojmdonidnjmiiodeaihpgela => Moved successfully.
C:\Users\Lauren\AppData\Local\Google\Chrome\User Data\Default\Extensions\mcbkbpnkkkipelfledbfocopglifcfmi => Moved successfully.
C:\Users\Lauren\AppData\Local\Google\Chrome\User Data\Default\Extensions\nafeecckidhijaofcfchkcaklajkfppo => Moved successfully.
C:\Users\Lauren\AppData\Local\Google\Chrome\User Data\Default\Extensions\eonmcijhojmdonidnjmiiodeaihpgela\2.0 directory not found.
C:\Users\Lauren\AppData\Local\Google\Chrome\User Data\Default\Extensions\nafeecckidhijaofcfchkcaklajkfppo\3.9 directory not found.
"HKLM\SOFTWARE\Policies\Google" => Key deleted successfully.
"C:\Users\Lauren\Local Settings" => ":init" ADS not found.
C:\Users\Lauren\AppData\Local => ":init" ADS removed successfully.
"C:\Users\Lauren\AppData\Local\Application Data" => ":init" ADS not found.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{9EAE3C6A-6865-4E69-AA46-611D1A7DC887}" => Key deleted successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{9EAE3C6A-6865-4E69-AA46-611D1A7DC887}" => Key deleted successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Microsoft\Windows\Maintenance\Idle~Crawler Update" => Key deleted successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Logon\{27BBB1D3-3C9B-463A-8C5F-EB97B025E006}" => Key deleted successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{27BBB1D3-3C9B-463A-8C5F-EB97B025E006}" => Key deleted successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Idle~Crawler Runner" => Key deleted successfully.

==== End of Fixlog ====

 

 

 

 

 

Malwarebytes Anti-Malware
www.malwarebytes.org

Scan Date: 8/18/2014
Scan Time: 9:03:39 PM
Logfile: Malwarebytes Log 8-18-14 (2).txt
Administrator: Yes

Version: 2.00.2.1012
Malware Database: v2014.08.19.01
Rootkit Database: v2014.08.16.01
License: Free
Malware Protection: Disabled
Malicious Website Protection: Disabled
Self-protection: Disabled

OS: Windows 7 Service Pack 1
CPU: x64
File System: NTFS
User: Lauren

Scan Type: Threat Scan
Result: Completed
Objects Scanned: 341979
Time Elapsed: 16 min, 10 sec

Memory: Enabled
Startup: Enabled
Filesystem: Enabled
Archives: Enabled
Rootkits: Disabled
Heuristics: Enabled
PUP: Enabled
PUM: Enabled

Processes: 0
(No malicious items detected)

Modules: 0
(No malicious items detected)

Registry Keys: 0
(No malicious items detected)

Registry Values: 0
(No malicious items detected)

Registry Data: 0
(No malicious items detected)

Folders: 0
(No malicious items detected)

Files: 2
PUP.Optional.AdLyrics, C:\Users\Lauren\AppData\Roaming\serv\ClickAndMark_2040-5250.exe, , [e28bc107f784bc7a37bfeebf8180748c],
PUP.Optional.IdleCrawler, C:\Users\Lauren\AppData\Roaming\serv\idlecrawler.exe, , [1e4f4f79a9d20630c4deb05548bd59a7],

Physical Sectors: 0
(No malicious items detected)


(end)

Link to post
Share on other sites

Everything looks good. The browsers appear to be back to normal and have no traces of start123 in the settings (search engines, homepage, etc.) but I found some suspicious files with the timestamp from the initial infection. The last MB scan detected 2 files that it did not detect before. I suspect this is because of a new update and that they were there all along, MB just didn't know about them.

 

C:\Users\Lauren\AppData\Roaming\serv\

 

download.dat                    8/16/2014    1:53 PM           (1kb)

hosts.exe                          8/16/2014    1:44 PM           (1,361kb)

java.exe                            8/16/2014    1:44 PM           (894kb)

PCSafePro.exe                 8/16/2014    1:44 PM           (5,210kb)

setup_fst_us.exe              8/16/2014    1:44 PM           (2,568kb)

 

 

I scanned them with Norton and MB and found no threats but PCSafePro just sounds suspicious and it was a java update that my wife downloaded that started this whole mess. Should I just delete these files and how will I know if all traces are gone if they are not showing as suspicious in the scans? Or maybe they are supposed to be there?

 

 

Other suspicious leftovers with roughly the same time stamp:

 

Users/Lauren/AppData/Local:

 

Fusion_Tech_Software,_LLC                  Subfolder is PCSafePRO.exe_Url_2zm5s1uwzdsmq5zbng1ejoisdk3v1neq which contains user.config in a subfolder.

Comodo/Dragon                                       (never heard of it before today)Contains some .js files in some of the sub folders.

Google/Chrome SxS/                               The subfolders appear identical (file folder names/structure and .js files) to those in the Comodo Dragon folder.

Packages/windows_ie_ac_001               Appears to be an empty file tree

CrashDumps                                             Contains a file called Idle~Crawler.exe.6860.dmp     (1,526 kb)

 

 

 

 

Users/Lauren/AppData/LocalLow:

{8F8E5068-F00F-0A09-3620-F9DD9462C1BB}/cosstminn.2.9.dat                   (1kb)
{77E76FB4-4A81-1CBD-B0F1-111BD0586897}/Adblocker.2.9.dat                    (1kb)
{E7E69E9E-C48B-4E34-BD20-0D16FCB4F606}/pricaeeChiop.2.9.dat             (1kb)
 

 

Users/Lauren/AppData/Roaming/device:

 

r.txt             (8kb)

t.txt             (109kb)

(They are junk when opened in notepad.)

 

 

My Documents/PCSafePro:

 

log.txt             (58kb)

logerror.txt      (1kb)

 

 

Program Files (x86)/yb_0728:

 

setup.exe          (296kb)

yb_0728.exe     (1,345kb)

 

 

Some of these files are duplicated in each of the User folders. Do I need to be concerned with any of these?

 

 

Link to post
Share on other sites

  • Root Admin

Glad we could help. :)

If you need this topic reopened, please send a Private Message to any one of the moderating team members. Please include a link to this thread with your request. This applies only to the originator of this thread.

Other members who need assistance please start your own topic in a new thread. Thanks!

Link to post
Share on other sites

Guest
This topic is now closed to further replies.
 Share

  • Recently Browsing   0 members

    • No registered users viewing this page.
Back to top
×
×
  • Create New...

Important Information

This site uses cookies - We have placed cookies on your device to help make this website better. You can adjust your cookie settings, otherwise we'll assume you're okay to continue.