Need help removing Vosteran and who knows what else

[Mandie]

My computer was hit when I downloaded FileZilla ftp client from SourceForge on Jan 2.  Unfortunately, I did not know about Malwarebytes, and so I tried a few things, including ADW cleaner.  When I finally found out about MB, I downloaded the free version, installed and ran it.  It found one entry for Vosteran.  But there is still some very flaky, unusual behavior on my laptop, such as I cannot perform a System Restore (says file is open and suggests shutting off my AV...not something i want to do).

 

When I rebooted, MB was no longer installed.  All I see are some remnants, such as a shortcut in Start>Programs, but there is just an empty folder under it.

 

So I followed the directions in MB forum, to download Farber Recovery Scan Tool from Bleeping Computer.  However, this file is from an "unknown publisher", AND there is a note in the file properties that "This file came from another computer and might be blocked to protect this computer"....with an UNBLOCK option.

 

I'm very skeptical of running this file (FRST64.exe).  Please advise.

 

 

[TwinHeadedEagle]

Hello,
    
 
They call me TwinHeadedEagle around here, and I'll be working with you.
 
     
    
Before we start please read and note the following:

• Limit your internet access to posting here, some infections just wait to steal typed-in passwords.
• Please be patient. I know it is frustrating when your PC isn't working properly, but malware removal takes time.
• Don't run any scripts or tools on your own, unsupervised usage may cause more harm than good.
• Do not paste the logs in your posts, attachments make my work easier. There is a More reply options button, that gives you Upload Files option below which you can use to attach your reports. Always attach reports from all tools.
• Always execute my instructions in given order. If for some reason you cannot completely follow one instruction, inform me about that.
• Stay with me to the end, the absence of symptoms doesn't mean that your machine is fully operational.
• Note that we may live in totally different time zones, what may cause some delays between answers.
• Do not ask for help for your business PC. Companies are making revenue via computers, so it is good thing to pay someone to repair it.
• If I don't hear from you within 3 days from this initial or any subsequent post, then this thread will be closed.

I can't foresee everything, so if anything unexpected happens, please stop and inform me!
There are no silly questions. Never be afraid to ask if in doubt!
 
 
 
  Rules and policies
 
We won't support any piracy.
That being told, if any evidence of illegal OS, software, cracks/keygens or any other will be revealed, any further assistance will be suspended. If you are aware that there is this kind of stuff on your machine, remove it before proceeding!
The same applies to any use of P2P software: uTorrent, BitTorrent, Vuze, Kazaa, Ares... We don't provide any help for P2P, except for their removal. All P2P software has to be uninstalled or at least fully disabled before proceeding!
 
Failure to follow these guidelines will result with closing your topic and withdrawning any assistance.
 
 
 
FRST is the tool used by hundreds of helpers everyday and is perfectly safe to use.

[Mandie]

Hi, Twin Headed Eagle.  Are you in Belgrade, Montana?

 

I'm just curious why FRST.exe is showing "From unknown publisher".  Is it possible that the download I received was compromised?  I will be more than happy to donate to your cause if we can get through this together.  Right now I'm afraid to do anything involving entering sensitive information.

 

Thanks,

 

Mandie

[TwinHeadedEagle]

Nope, I am in Belgrade, Serbia 

 

To remove Unknown Publisher, you need to pay for it and it is not cheap. Most developers volunteer their time and do not have money to pay, that is why most of our tools aren't digitally signed.

But as I've said, every tool we suggest here is perfectly legitimate and safe to use, no matter what Windows or your Antivirus think about it.

[Mandie]

Okay, do you want me to run FBST now?  If so, which specific options to check (i.e. everything in the "Whitelist", anything in the "Optional Scan", Search Files, Search Registry, "FIX"?

[TwinHeadedEagle]

Just open FRST, and press Scan without touching any options.

[Mandie]

Okay, i have two text files to send you, but i don't see the "attachment" icon in this post box.

[TwinHeadedEagle]

There is a More reply options button, that gives you Upload Files option below which you can use to attach your reports. Always attach reports from all tools.

[Mandie]

THE, attached are the Farbar results.

Addition.txt

FRST.txt

[TwinHeadedEagle]

Fix with Farbar Recovery Scan Tool
 

This fix was created for this user for use on that particular machine.
Running it on another one may cause damage and render the system unstable.

 
Download attached fixlist.txt file and save it to the Desktop:
 
Both files, FRST and fixlist.txt have to be in the same location or the fix will not work!

• Right-click on icon and select Run as Administrator to start the tool.
  (XP users click run after receipt of Windows Security Warning - Open File).
• Press the Fix button just once and wait.
• If for some reason the tool needs a restart, please make sure you let the system restart normally. After that let the tool complete its run.
• When finished FRST will generate a log on the Desktop, called Fixlog.txt.

Please attach it to your reply.
 
 
 
 

Scan with Malwarebytes' Anti-Malware
 
Please download Malwarebytes Anti-Malware and save it to your desktop.

• Install the progam and select update.
• Once updated, click the Settings tab, in the left panel choose Detection & Protection and tick Scan for rootkits.
• Click the Scan tab, choose Threat Scan is checked and click Scan Now.
• If threats are detected, click the Apply Actions button. You will now be prompted to reboot. Click Yes.
• Upon completion of the scan (or after the reboot), click the History tab.
• Click Application Logs and double-click the Scan Log.
• At the bottom click Export and choose Text file.

Save the file to your desktop and include its content in your next reply.

fixlist.txt

[Mandie]

Attached are the two files you requested (fixlog and scanlog). 

 

Note:  The instructions for MBAM install indicate that i would be prompted for a re-boot.  That didn't happen.  I rebooted anyway, and when I logged back in and opened Chrome, the following two extensions were completely removed (NOT just disabled).  Like they were never there: Kaspersky Virtual Keyboard and LastPass.

 

When I do banking, etc., I open Kaspersky Safe Money/Virtual Keyboard which opens a "protected browser" mode.  I tried a test to see if that still works....and it does NOT.

 

So....is my browser still hijacked?

 

Thanks, awaiting your response for next steps!

Mandie_MBAM_ScanLog_Jan19_4pm.txt

Fixlog.txt

[TwinHeadedEagle]

Please attach fresh FRST reports, but without changing anything within reports
 
Scan with Farbar Recovery Scan Tool
 
Please re-run Farbar Recovery Scan Tool to give me a fresh look at your system.

• Right-click on icon and select Run as Administrator to start the tool.
  (XP users click run after receipt of Windows Security Warning - Open File).
• Make sure that Addition option is checked.
• Press Scan button and wait.
• The tool will produce two logfiles on your desktop: FRST.txt and Addition.txt.

Please upload them into your next reply.

[Mandie]

Results of re-run of FRST attached.

mandie_Addition.txt

mandie_FRST.txt

[TwinHeadedEagle]

Fix with Farbar Recovery Scan Tool
 

This fix was created for this user for use on that particular machine.
Running it on another one may cause damage and render the system unstable.

 
Download attached fixlist.txt file and save it to the Desktop:
 
Both files, FRST and fixlist.txt have to be in the same location or the fix will not work!

• Right-click on icon and select Run as Administrator to start the tool.
  (XP users click run after receipt of Windows Security Warning - Open File).
• Press the Fix button just once and wait.
• If for some reason the tool needs a restart, please make sure you let the system restart normally. After that let the tool complete its run.
• When finished FRST will generate a log on the Desktop, called Fixlog.txt.

Please post it to your reply.

fixlist.txt

[Mandie]

Results attached.

mandie_Fixlog_jan20.txt

[TwinHeadedEagle]

How is your PC now?

[Mandie]

Some of the crazy symptoms I have been experiencing since this infection:

 

1.  Not able to upgrade to IE 11.  No, I don't actually USE this browser, but it can't be removed from the Windows 7 OS.  So i in the interest of security, I have been trying to upgrade, but it has been failing.

 

2.  System restore to the point just before the Vosteran infection.  Usually, system restore works flawlessly to recover after a mishap with a driver installation.  I am able to perform restores AFTER this infection...just not before....

 

So, I am going to try to perform the above (upgrade IE, and perform a System Restore to January 1) and will update these notes to let you know how that went.

 

Thanks.

[TwinHeadedEagle]

Why we did all these steps if you're going to perform system restore now. You could have done it in the beginning.

[Mandie]

System Restore was the very first troubleshooting step I tried !!  And I indicated that right from the start.  Following is an excerpt:

 

"....such as I cannot perform a System Restore (says file is open and suggests shutting off my AV..."

 

I have tried a number of times from various Restore Points prior to the infection, and none of them were successful.  It would go through the motions, reboot, and then fail, stating something like, "System Restore was NOT successful.  A file was open..."

 

It is now three weeks into this problem.  I have been pulling my hair out trying to get it fixed, and this extremely slow process of troubleshooting on the Malwarebytes forum, with techs in different international time zones, is making it even more stressful.  I don't feel I can do any online banking or other "secure" things I need to do.

 

So, basically, as I indicated in my most recent post, I wanted to try to get IE 11 to install (install continues to fail), and also wanted to re-try (for the 20th time) the System Restore from January 1, which I haven't done yet because I'm trying to get caught up on what work I CAN do on my computer.

 

As soon as I can, I'll try, yet again, another System Restore from Jan 1.  I'll post the results here as soon as it is done.  Thanks.

[TwinHeadedEagle]

Okay, keep me posted.

[Mandie]

I tried one last time to get a System Restore to work.  It doesn't.  Since we can't really know if this is related to malware or not, I'll put that aside and assume that it cannot be resolved at this point.

 

Yesterday things seemed rather normal.  But today Chrome is behaving unpredictably.  Sometimes I double-click on something or right-click, and nothing happens.  I have not been able to get Kaspersky Safe Money to be enabled, in spite of doing everything Kaspersky has recommended.

 

I'm attaching another iteration of FRST and addition.  Perhaps you can see if something else has come up that didn't come up the first time.

 

If you decide you don't work this case any longer, let me know.

Addition.txt

FRST.txt

[TwinHeadedEagle]

Yes, System Restore is known to be a buggy thing, I had few problems myself.

 

We checked your PC thoroughly and I do not think any malware is causing this.

 

Try to reinstall Chrome and Kaspersky, I spotted some errors that indicate some corruption.

[Mandie]

I reinstalled Chrome (for the 2nd time), and also reinstalled Kaspersky.  Chrome is still behaving very flaky.  It won't allow Kaspersky Safe Banking or Virtual Keyboard.  Various features appear and then disappear.  Internet Explorer is broken.

 

I also now have several dllhost.exe processes appearing briefly in Task Manager before they disappear.  This is most definitely a virus, according to Bleeping Computer, Norton, Symantec.  This is a "COM surrogate" virus called Poweliks.

 

Would you be able to take a look again at new Farbar log results?

[TwinHeadedEagle]

Scan with Farbar Recovery Scan Tool
 
Please re-run Farbar Recovery Scan Tool to give me a fresh look at your system.

• Right-click on icon and select Run as Administrator to start the tool.
  (XP users click run after receipt of Windows Security Warning - Open File).
• Make sure that Addition option is checked.
• Press Scan button and wait.
• The tool will produce two logfiles on your desktop: FRST.txt and Addition.txt.

Please include their content into your next reply.

[Mandie]

My apologies for the delayed response.  My computer was in such a state that I did not want to use it, so I took it to a local computer repair shop.  They said if I do have Poweliks, I definitely do NOT want to do anything on it, especially entering sensitive info.  So I left my computer with them for a few days.  I'm typing this on my partner's computer.

 

Thank you for your help thus far.  There is no need to use up any more of your time trying to help me with this issue.  You can consider it closed.