Trojan.Kelihos infection?

[Kyle129]

Hello..

 

My computer is running slow suddenly.

 

I've scanned with malwarebytes which found several files infected with Trojan.kelihos.    It just seems to remove the temp files and not fix the problem.

 

Attached are the FRST logs

 

Would some be able to take a look?

 

Thank you in advance

 

-Kyle

 

Addition.txt

FRST.txt

[kevinf80]

Hello and

 

P2P/Piracy Warning:

 

If you're using Peer 2 Peer software such as uTorrent, BitTorrent or similar you must either fully uninstall them or completely disable them from running while being assisted here.Failure to remove or disable such software will result in your topic being closed and no further assistance being provided.If you have illegal/cracked software, cracks, keygens etc. on the system, please remove or uninstall them now and read the policy on Piracy.

 

Download attached fixlist.txt file (end of reply) and save it to the Desktop, or the folder you saved FRST into.

NOTE. It's important that both FRST and fixlist.txt are in the same location or the fix will not work.

 

Run FRST and press the Fix button just once and wait.

The tool will make a log on the Desktop (Fixlog.txt) or the folder it was ran from. Please post it to your reply.

 

Next,

 

Open Malwarebytes Anti-Malware, from the Dashboard please Check for Updates by clicking the Update Now... link

When the update completes select > Settings > Detection and Protection > Enable Scan for rootkit and Under Non Malware Protection set both PUP and PUM to Treat detections as malware.

 

 

Click on the SCAN button and run a Threat Scan with Malwarebytes Anti-Malware by clicking the Scan Now>> button.

 

When the scan is complete, if there have been detections, click Apply Actions to allow MBAM to clean what was detected.

 

 

In most cases, a restart will be required.

 

 

Wait for the prompt to restart the computer to appear, then click on Yes.

 

 

Once completed please click on the History > Application Logs and find your scan log and open it and then click on the "copy to clipboard" button and post back the results on your next reply.

 

Next,

 

Download AdwCleaner by Xplode onto your Desktop.

• 
  

Double click on Adwcleaner.exe to run the tool.
Click on Scan
Once the scan is done, click on the Clean button.
You will get a prompt asking to close all programs. Click OK.
Click OK again to reboot your computer.
A text file will open after the restart. Please post the content of that logfile in your reply.
You can also find the logfile at C:\AdwCleaner[sn].txt. Where n in the scan reference number

 

Next,

 

Please download Junkware Removal Tool to your desktop.

• 
  

Shut down your protection software now to avoid potential conflicts. (re-enable when done)
Run the tool by double-clicking it. If you are using Windows Vista, 7, or 8; instead of double-clicking, right-mouse click JRT.exe and select "Run as Administrator".
The tool will open and start scanning your system.
Please be patient as this can take a while to complete depending on your system's specifications.
On completion, a log (JRT.txt) is saved to your desktop and will automatically open.
Post the contents of JRT.txt into your next message.

 

Next,

 

Download Microsoft's " Malicious Software Removal Tool" and save direct to the desktop

Ensure to get the correct version for your system....

32 Bit version:

https://www.microsoft.com/downloads/en/confirmation.aspx?FamilyId=AD724AE0-E72D-4F54-9AB3-75B8EB148356&displaylang=en

64 Bit version:

https://www.microsoft.com/downloads/en/confirmation.aspx?FamilyId=585D2BDE-367F-495E-94E7-6349F4EFFC74&displaylang=en'>https://www.microsoft.com/downloads/en/confirmation.aspx?FamilyId=585D2BDE-367F-495E-94E7-6349F4EFFC74&displaylang=en

 

Right click on the Tool, select “Run as Administrator” the tool will expand to the options Window

In the "Scan Type" window, select Quick Scan

Perform a scan and  Click Finish when the scan is done.

Retrieve the MSRT log as follows, and post it in your next reply:

 

1) Select the Windows key and R key together to open the "Run" function

2) Type or Copy/Paste the following command to the "Run Line" and Press Enter:

 

notepad c:\windows\debug\mrt.log

 

Let me see those logs in your next reply...

 

Kevin...

[Kyle129]

Thanks Kevin...

 

I don't see a fixlist.txt attachment at the end?

 

 

-Kyle

[kevinf80]

Apologies Kyle 129, did not realize I make that mistake. Is attached this time....

 

Kevin.

Fixlist.txt

[Kyle129]

no worries... thanks for you help.

 

-Kyle

[kevinf80]

Anytime.......

[Kyle129]

Hi Kevin...

 

All steps followed.

 

Malwarebytes didn't find anything.  Log was empty.

 

MRT also didn't find anything.  No log in c:\windows\debug

 

Other logs attached.

 

Thanks again.

 

-Kyle

 

 

AdwCleanerS1.txt

Fixlog.txt

JRT.txt

[kevinf80]

Thanks for the update and logs, we still need to run an online AV scan to ensure there are no remnants of any infection left on your system that may have been missed. This scan is very thorough and well worth running, it can take several hours please be patient and let it complete:

 

Run Eset Online Scanner

 

**Note** You will need to use Internet explorer for this scan - Vista and Windows 7/8 right click on IE shortcut and run as admin.

 

(To run ESET Online Scanner in a browser other than Internet Explorer, you'll need to download ESET SMART  Installer during the process)

 

Go to Eset web page http://www.eset.com/us/online-scanner/ to run an online scan from ESET.

 

• 
  

Turn off the real time scanner of any existing antivirus program while performing the online scan
click on the Run ESET Online Scanner button
Tick the box next to YES, I accept the Terms of Use.
Click Start
When asked, allow the add/on to be installed
Click Start
Make sure that the option "Remove found threats"  is UNticked
Click on Advanced Settings, ensure the following options are checked:
 
Scan for potentially unsafe applications
Enable Anti-Stealth Technology
 
Click Scan
wait for the virus definitions to be downloaded
Wait for the scan to finish

 

When the scan is complete

 

• 
  

If no threats were found
put a checkmark in "Uninstall application on close"
close program
report to me that nothing was found

 

If threats were found

 

• 
  

click on "list of threats found"
click on "export to text file" and save it as ESET SCAN and save to the desktop
Click on back
put a checkmark in "Uninstall application on close"
click on finish

 

close program

 

Copy and paste the report in next reply, also give an update on any remaining issues or concerns...

 

Thank,

 

Kevin...

[Kyle129]

Hi Keivn;

 

Ran ESET.

 

Found two items.

 

Log below.

 

I thought you might like a FRST log again after ESET so I attached that too.

 

 

Thanks.

 

-Kyle

 

 

 

 

 

Addition.txt

eset1.txt

FRST.txt

[kevinf80]

ESET entries are of no concern, system looks good to go. Couple of utility issues to fix as follows:

 

Adobe Reader is outdated...

Visit http://get.adobe.com/uk/reader/otherversions/ and download the latest version of Acrobat Reader

 

Step 1 - Select your Operating System.

Step 2 - Select your Langauge.

Step 3 - Select latest version.

 

Untick the option for any security scanner or toolbar if offered.

 

Download and install.

 

Having the latest updates ensures there are no security vulnerabilities in your system.

 

Next,

 

Your Java is out of date. Older versions have vulnerabilities that malware can use to infect your system.

Please follow these steps to remove older version of Java components and upgrade the application.

 

Upgrading Java:

 

Go to http://java.com/en/ and click on "Do I have Java"

It will check your current version and then offer to update to the latest version

Watch for and make sure you untick the box next to whatever free program they prompt you to install during the installation, unless you want it.

 

***Note: Check in Programs and Features (or Add/Remove Programs if you are an XP user) to make certain there are no old versions of Java still installed, if so - remove them. <<-- Very Important

 

Finally,

 

Download "Delfix by Xplode" and save it to your desktop.

 

Or use the following if first link is down:

 

"Delfix link mirror"

 

Double Click to start the program. If you are using Vista or higher, please right-click and choose run as administrator

 

Make Sure the following items are checked:

 

• 
  

    Activate UAC
    Remove disinfection tools
     Create registry backup
    Purge System Restore
    Reset system settings

 

Now click on "Run" and wait patiently until the tool has completed.

 

The tool will create a log when it has completed. We don't need you to post this.

 

Part of the routine will be to create a registry back up with ERUNT,  the back up will be created here:

 

C:\Windows\ERUNT

 

When all is known to be well with your system you can delete that back up folder if you consider it as not needed...

Any remnant files/logs from tools we have used can be deleted…

 

Next,

 

Read the following link to fully understand PC security and best practices, you may find it useful....

 

http://www.bleepingcomputer.com/forums/t/407147/answers-to-common-security-questions-best-practices/#entry2316629

 

If no remaining issues or concerns let me know if we can close out...

 

Thank you,

 

Kevin...

[Kyle129]

Hi Kevin...

 

Thanks again for all your help...

 

I'm not sure what is wrong with it... it's still way slower than before the issue.

 

I didn't realize that I hadn't done the windows updates in some time.    Still IE8.   Doing updates now and the others above.  I'll let you know when done.

 

-Kyle

[kevinf80]

Thanks for the update, let me know if you still have any remaining issues or concerns when ready..

 

Cheers,

 

Kevin..

[Kyle129]

HI Kevin....

 

Still real slow/performance problems.  When IE is opened it just hangs or takes at lest a minute to load the home page. 

 

 I scanned with Malwarebytes before going to bed last night...  Lots of Kelihos found. 

 

Malwarebyes and FRST logs attached.

 

Thanks again.

 

-Kyle

 

Addition.txt

FRST.txt

mblog.txt

[kevinf80]

Those files are related to symatec endpoint security, specifically the anti-virus component, see the event viewer logs:

 

 

Error: (10/20/2014 11:15:53 PM) (Source: Symantec AntiVirus) (EventID: 51) (User: )
Description: Security Risk Found!Trojan.Gen in File: C:\Users\Rich\AppData\Local\Temp\DWH9796.tmp by: Auto-Protect scan.  Action: Quarantine succeeded : Access denied.  Action Description: The file was quarantined successfully.

Error: (10/20/2014 04:24:47 PM) (Source: Symantec AntiVirus) (EventID: 51) (User: )
Description: Security Risk Found!Trojan.Gen in File: C:\Users\Rich\AppData\Local\Temp\DWH72F7.tmp by: Auto-Protect scan.  Action: Quarantine succeeded : Access denied.  Action Description: The file was quarantined successfully.

Error: (10/20/2014 04:24:27 PM) (Source: Symantec AntiVirus) (EventID: 51) (User: )
Description: Security Risk Found!Trojan.Gen in File: C:\Users\Rich\AppData\Local\Temp\DWH4255.tmp by: Auto-Protect scan.  Action: Quarantine succeeded : Access denied.  Action Description: The file was quarantined successfully.

Error: (10/20/2014 04:24:06 PM) (Source: Symantec AntiVirus) (EventID: 51) (User: )
Description: Security Risk Found!Trojan.Gen in File: C:\Users\Rich\AppData\Local\Temp\DWH234F.tmp by: Auto-Protect scan.  Action: Quarantine succeeded : Access denied.  Action Description: The file was quarantined successfully.

Error: (10/20/2014 04:23:46 PM) (Source: Symantec AntiVirus) (EventID: 51) (User: )
Description: Security Risk Found!Trojan.Gen in File: C:\Users\Rich\AppData\Local\Temp\DWHF665.tmp by: Auto-Protect scan.  Action: Quarantine succeeded : Access denied.  Action Description: The file was quarantined successfully.

Error: (10/20/2014 04:23:27 PM) (Source: Symantec AntiVirus) (EventID: 51) (User: )
Description: Security Risk Found!Trojan.Gen in File: C:\Users\Rich\AppData\Local\Temp\DWHD991.tmp by: Auto-Protect scan.  Action: Quarantine succeeded : Access denied.  Action Description: The file was quarantined successfully.
 

 

As the files are generated to a temp folder Malwarebytes will flag them as a threat when a scan is run....

 

Have a read at the following link:

 

http://www.symantec.com/business/support/index?page=content&id=TECH102953

 

Maybe you will need to contact Symantec support and ask for advice...

 

Let me know what you think....

[Kyle129]

Thanks again Kevin... that was very helpful.

 

I uninstalled SEP and put the latest version of NAV on after cleaning out all the temp files.

 

All is good,  performance improved and there are no further issues.

 

I appreciate your help.

 

-Kyle

[kevinf80]

Hiya Kyle,

 

Thanks for the update, good to hear all is now sorted and back to normal....

 

It was a pleasure to work with you, take care and surf safe,

 

Kevin.

[AdvancedSetup]

Glad we could help.

If you need this topic reopened, please send a Private Message to any one of the moderating team members. Please include a link to this thread with your request. This applies only to the originator of this thread.

Other members who need assistance please start your own topic in a new thread. Thanks!