Patrick8 Posted October 23, 2014 ID:894647 Share Posted October 23, 2014 I have been fighting this for a few days now. I was reading other threads and have attached some logs please let me know if you can help or need any other information. Thanks in advance Here is the malwarebytes scan Malwarebytes Anti-Malwarewww.malwarebytes.org Scan Date: 10/22/2014Scan Time: 5:10:57 PMLogfile: malwarebytes.txtAdministrator: Yes Version: 2.00.3.1025Malware Database: v2014.10.22.10Rootkit Database: v2014.10.22.01License: TrialMalware Protection: EnabledMalicious Website Protection: EnabledSelf-protection: Disabled OS: Windows 7 Service Pack 1CPU: x64File System: NTFSUser: Angelique Scan Type: Threat ScanResult: CompletedObjects Scanned: 346138Time Elapsed: 19 min, 53 sec Memory: EnabledStartup: EnabledFilesystem: EnabledArchives: EnabledRootkits: DisabledHeuristics: EnabledPUP: EnabledPUM: Enabled Processes: 0(No malicious items detected) Modules: 0(No malicious items detected) Registry Keys: 0(No malicious items detected) Registry Values: 0(No malicious items detected) Registry Data: 0(No malicious items detected) Folders: 0(No malicious items detected) Files: 0(No malicious items detected) Physical Sectors: 0(No malicious items detected) (end)Addition.txtFRST.txtRKreport_SCN_10222014_174825.log Link to post Share on other sites More sharing options...
MrCharlie Posted October 23, 2014 ID:894652 Share Posted October 23, 2014 Make sure you have created a restore point and..... Download Delfix from Here and save it to your desktop.Place a check mark in front of .......Create registry backup <---only!Uncheck the rest!Click the Run button. Close the tool out when it's done....we'll use it later. ==================== Download the attached fixlist.txt to the same folder as FRST.exe/FRST64.exe. Run FRST.exe/FRST64.exe and click Fix only once and wait The tool will create a log (Fixlog.txt) in the folder, please post it to your reply. =================== Please download and run ComboFix. The most important things to remember when running it is to disable all your malware programs and run Combofix from your desktop. Please visit this webpage for download links, and instructions for running ComboFix http://www.bleepingcomputer.com/combofix/how-to-use-combofix http://www.bleepingcomputer.com/download/combofix/dl/12/ <---ComboFix direct download Please make sure you click download buttons that look similar to this, not "sponsored ad links": Ensure you have disabled all anti virus and anti malware programs so they do not interfere with the running of ComboFix. Information on disabling your malware programs can be found Here. Make sure you run ComboFix from your desktop. Give it at least 30-45 minutes to finish if needed. Please include the C:\ComboFix.txt in your next reply for further review. ---------->NOTE<----------If you get the message Illegal operation attempted on registry key that has been marked for deletion after you run ComboFix....please reboot the computer, this should resolve the problem. You may have to do this several times if needed. MrC Link to post Share on other sites More sharing options...
Patrick8 Posted October 23, 2014 Author ID:894681 Share Posted October 23, 2014 Here Are The Files. Thanks!ComboFix.txtFixlog1.txt Link to post Share on other sites More sharing options...
MrCharlie Posted October 23, 2014 ID:894688 Share Posted October 23, 2014 These are very suspicious: (do you recognize them)(just look, don't click on anything!)c:\programdata\Microsoft\PlayReady\oodehbff\Vzjgiqgkbwpg\Cbeueosz.jsc:\programdata\Microsoft\PlayReady\oodehbff\hucxhgpwhq\lcwkajhuqq.js========================Can you see what's inside of this folder:C:\7b2b1fdDelete this file:c:\users\Angelique\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\7b2b1fd.exe.virMrC Link to post Share on other sites More sharing options...
Patrick8 Posted October 23, 2014 Author ID:894694 Share Posted October 23, 2014 I do not recognize those files 7b2b1fd is empty i did delete something out of there earlier but looks like the file came back. file was 7b2b1fd.exe.vir Deleted File c:\users\Angelique\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\7b2b1fd.exe.vir Link to post Share on other sites More sharing options...
MrCharlie Posted October 23, 2014 ID:894697 Share Posted October 23, 2014 The part in bold is legitimate, but the rest in red is malware: c:\programdata\Microsoft\PlayReady\oodehbff\Vzjgiqgkbwpg\Cbeueosz.js c:\programdata\Microsoft\PlayReady\oodehbff\hucxhgpwhq\lcwkajhuqq.js See if you can delete this folder c:\programdata\Microsoft\PlayReady\oodehbff That will get rid of it all Let me know, MrC MrC Link to post Share on other sites More sharing options...
Patrick8 Posted October 23, 2014 Author ID:894698 Share Posted October 23, 2014 Yes I was able to delete the file. Link to post Share on other sites More sharing options...
MrCharlie Posted October 23, 2014 ID:894705 Share Posted October 23, 2014 It was a folder correct??? How is it running??? MrC Link to post Share on other sites More sharing options...
Patrick8 Posted October 23, 2014 Author ID:894709 Share Posted October 23, 2014 Yes it was a folder. at this point im not getting the website block from the malwarebytes and I am down to one dllhost.exe. seems its all cleaned up! Link to post Share on other sites More sharing options...
MrCharlie Posted October 23, 2014 ID:894715 Share Posted October 23, 2014 Good..... Lets check your computers security before you go and we have a little cleanup to do also: Download Security Check by screen317 from HERE or HERE.Save it to your Desktop.Double click SecurityCheck.exe and follow the onscreen instructions inside of the black box.If you get Unsupported operating system. Aborting now, just reboot and try again.A Notepad document should open automatically called checkup.txt.Please Post the contents of that document.Do Not Attach It!!!MrC (be back in the AM) Link to post Share on other sites More sharing options...
Patrick8 Posted October 23, 2014 Author ID:894718 Share Posted October 23, 2014 File is attached. Thankscheckup.txt Link to post Share on other sites More sharing options...
MrCharlie Posted October 23, 2014 ID:894885 Share Posted October 23, 2014 Results of screen317's Security Check version 0.99.89 Windows 7 Service Pack 1 x64 (UAC is enabled) Internet Explorer 11 ``````````````Antivirus/Firewall Check:`````````````` Windows Firewall Enabled! Microsoft Security Essentials (On Access scanning disabled!) Error obtaining update status for antivirus! `````````Anti-malware/Other Utilities Check:````````` Wise Disk Cleaner 8.32 Wise Registry Cleaner 8.23 Java 7 Update 71 Java version out of Date! Adobe Reader XI ````````Process Check: objlist.exe by Laurent```````` Microsoft Security Essentials MSMpEng.exe Malwarebytes Anti-Malware mbamservice.exe Malwarebytes Anti-Malware mbam.exe Malwarebytes Anti-Malware mbamscheduler.exe `````````````````System Health check````````````````` Total Fragmentation on Drive C: 3% ````````````````````End of Log`````````````````````` Link to post Share on other sites More sharing options...
MrCharlie Posted October 23, 2014 ID:894886 Share Posted October 23, 2014 The Java version is correct ======================== A little clean up to do.... Please Uninstall ComboFix: (------->if you used it<-------) Press the Windows logo key + R to bring up the "run box" Copy and paste next command in the field: ComboFix /uninstall Make sure there's a space between Combofix and / Then hit enter. (it may look like CF is re-installing but it's not) This will uninstall Combofix, delete its related folders and files, hide file extensions, hide the system/hidden files and clears System Restore cache and create new Restore point (If that doesn't work.....you can simply rename ComboFix.exe to Uninstall.exe and double click it to complete the uninstall or download and run the uninstaller) --------------------------------- Download Delfix from here and save it to your desktop. (you may already have this)Ensure Remove disinfection tools is checked.Click the Run button.RebootAny other programs or logs that are still remaining, you can manually delete. (right click.....Delete) IE: RogueKiller.exe, RKreport.txt, RK_Quarantine folder, C:\FRST folder, FRST-OlderVersion folder, MBAR folder, etc....AdwCleaner > just run the program and click uninstall. Note: If you used FRST and can't delete the quarantine folder: Download the fixlist.txt to the same folder as FRST.exe. Run FRST.exe and click Fix only once and wait That will delete the quarantine folder created by FRST. The rest you can manually delete. ------------------------------- Any questions...please post back. If you think I've helped you, please leave a comment > click on my avatar picture > click Profile Feed. Take a look at My Preventive Maintenance to avoid being infected again. Good Luck and Thanks for using the forum, MrC Link to post Share on other sites More sharing options...
Patrick8 Posted October 23, 2014 Author ID:895144 Share Posted October 23, 2014 Thank you so much for all the help! Everything is running perfect now. Link to post Share on other sites More sharing options...
MrCharlie Posted October 23, 2014 ID:895160 Share Posted October 23, 2014 OK...Take Care MrC Link to post Share on other sites More sharing options...
Root Admin AdvancedSetup Posted October 25, 2014 Root Admin ID:895949 Share Posted October 25, 2014 Glad we could help. If you need this topic reopened, please send a Private Message to any one of the moderating team members. Please include a link to this thread with your request. This applies only to the originator of this thread. Other members who need assistance please start your own topic in a new thread. Thanks! Link to post Share on other sites More sharing options...
Recommended Posts