rozey Posted February 5, 2015 ID:936646 Share Posted February 5, 2015 malwarebytes detected Trojan Fake MS registry key and quarantined, also had blinkxcore sending outbound messages that were stopped. Tried a system restore got following message " system restore failed while copying the registry from the restore point. An unspecified error occurred during system restore 0x80070570. retried and got system restore failed while scanning file system on the drive C. the drive might be corrupt .You might what to retry system restore after running chkdsk/r on this drive. An unspecified error occurred during system restore 0x81000204. Any ideas? Link to post Share on other sites More sharing options...
kevinf80 Posted February 5, 2015 ID:936734 Share Posted February 5, 2015 Hello and welome, P2P/Piracy Warning: If you're using Peer 2 Peer software such as uTorrent, BitTorrent or similar you must either fully uninstall them or completely disable them from running while being assisted here.Failure to remove or disable such software will result in your topic being closed and no further assistance being provided.If you have illegal/cracked software, cracks, keygens etc. on the system, please remove or uninstall them now and read the policy on Piracy. Did you try running the command chkdsk /r Run the following to have a look at your system..... Download Farbar Recovery Scan Tool and save it to your desktop. Note: You need to run the version compatible with your system (32 bit or 64 bit). If you are not sure which version applies to your system download both of them and try to run them. Only one of them will run on your system, that will be the right version.Double-click to run it. When the tool opens click Yes to disclaimer.Press Scan button.It will make a log (FRST.txt) in the same directory the tool is run. Please copy and paste it to your reply.The first time the tool is run, it makes also another log (Addition.txt). Please attach it to your reply. Post the produced logs in next reply... Thanks, Kevin... Link to post Share on other sites More sharing options...
rozey Posted February 6, 2015 Author ID:936830 Share Posted February 6, 2015 Kevin,Thanks for the reply , yes I did try chkdsk/r I forget the exact terms but said it was corrupt registry key quarantined by malwarebytes HKLM\SOFTWARE\CLASSES\CLSID\{2D349E57-23E4-4A67-9624-F1DC6B65AABF}file removed by malwarebytes C:\ProgramData\{F66CB4EE-546F-4D54-9332-216DE189AAB0}\neth.dll time of infection approx. 1230 am 1/29FRST.txtAddition.txt Link to post Share on other sites More sharing options...
kevinf80 Posted February 6, 2015 ID:936909 Share Posted February 6, 2015 No obvious malware/infection showing in those logs, one point have you had help via remote connection? Continue as follows: Open Malwarebytes Anti-Malware, from the Dashboard please Check for Updates by clicking the Update Now... linkWhen the update completes select > Settings > Detection and Protection > Enable Scan for rootkit and Under Non Malware Protection set both PUP and PUM to Treat detections as malware. Click on the SCAN button and run a Threat Scan with Malwarebytes Anti-Malware by clicking the Scan Now>> button. When the scan is complete, if there have been detections, click Apply Actions to allow MBAM to clean what was detected. In most cases, a restart will be required. Wait for the prompt to restart the computer to appear, then click on Yes. When the scan is completed from the main GUI click on History > Application Logs. Find your Scan log, the date when run will identify it. Checkmark "select" box > then hit the "view" button. The history log window will open. At the bottom of that window are two options, "Copy to clipboard" and "Export" Select > "Copy to clipboard" that copies the full log to the windows clipboard, so at your reply you right click into the text field and select "Paste" the log is pasted (copied) to your reply. Next, Download AdwCleaner by Xplode onto your Desktop. Double click on Adwcleaner.exe to run the tool. Click on Scan Once the scan is done, click on the Clean button. You will get a prompt asking to close all programs. Click OK. Click OK again to reboot your computer. A text file will open after the restart. Please post the content of that logfile in your reply. You can also find the logfile at C:\AdwCleaner[sn].txt. Where n in the scan reference number Next, Please download Junkware Removal Tool to your desktop.Shut down your protection software now to avoid potential conflicts. (re-enable when done)Run the tool by double-clicking it. If you are using Windows Vista, 7, or 8; instead of double-clicking, right-mouse click JRT.exe and select "Run as Administrator".The tool will open and start scanning your system.Please be patient as this can take a while to complete depending on your system's specifications.On completion, a log (JRT.txt) is saved to your desktop and will automatically open.Post the contents of JRT.txt into your next message. Next, Download Microsoft's " Malicious Software Removal Tool" and save direct to the desktopEnsure to get the correct version for your system.... 32 Bit version:https://www.microsoft.com/downloads/en/confirmation.aspx?FamilyId=AD724AE0-E72D-4F54-9AB3-75B8EB148356&displaylang=en64 Bit version:https://www.microsoft.com/downloads/en/confirmation.aspx?FamilyId=585D2BDE-367F-495E-94E7-6349F4EFFC74&displaylang=en'>https://www.microsoft.com/downloads/en/confirmation.aspx?FamilyId=585D2BDE-367F-495E-94E7-6349F4EFFC74&displaylang=en Right click on the Tool, select “Run as Administrator” the tool will expand to the options WindowIn the "Scan Type" window, select Quick ScanPerform a scan and Click Finish when the scan is done.Retrieve the MSRT log as follows, and post it in your next reply: 1) Select the Windows key and R key together to open the "Run" function2) Type or Copy/Paste the following command to the "Run Line" and Press Enter: notepad c:\windows\debug\mrt.log Next, Fix with ESET Services Repair Please download Services Repair by ESET and save it to your desktop. Right-click on icon and select Run as Administrator to start the tool.If security notifications appear, click Continue or Run.Accept the prompt about restoring services.Once the tool has finished, you will be prompted to restart your computer. Click Yes to restart.A log will be saved in the CCSupport folder the tool created on your desktop. Please include that logfile in your next reply. Let me see those logs, also give an update on any remaining issues or concerns... Thank you, Kevin.. Link to post Share on other sites More sharing options...
rozey Posted February 7, 2015 Author ID:937207 Share Posted February 7, 2015 Kevin,Thanks for your help I will give this a try this weekend. Also does it matter that I downloaded The Farbar to C drive...couldn't get it on the desktop. And can I remove from C drive?SHaron Link to post Share on other sites More sharing options...
kevinf80 Posted February 7, 2015 ID:937278 Share Posted February 7, 2015 Hello Sharon, you can d/l and save FRST to any folder you want, it will run ok... Kevin... Link to post Share on other sites More sharing options...
rozey Posted February 9, 2015 Author ID:937797 Share Posted February 9, 2015 Hey Kevin,I did those scans you suggested and here are the logs except for the one from Fix with ESET Services Repair. I just can't seem to find it. Also in the addition scan report from Farbar under the first entry for CLSID is registry key quarantined by malwarebytes HKLM\SOFTWARE\CLASSES\CLSID\{2D349E57-23E4-4A67-9624-F1DC6B65AABF} does this mean it's been removed ? Is the computer all clear from the Trojan and safe to use ?Thanks for checking these logs for meSharon AdwCleanerS0.txtJRT.txtmrt.logmalwarebytes log.txt Link to post Share on other sites More sharing options...
rozey Posted February 9, 2015 Author ID:937798 Share Posted February 9, 2015 Kevin,Sorry I just found this log ....it was hiding SvcRepair.log Link to post Share on other sites More sharing options...
kevinf80 Posted February 9, 2015 ID:937823 Share Posted February 9, 2015 What is the current status, any issues or conceerns... logs look good. Thanks, Kevin Link to post Share on other sites More sharing options...
rozey Posted February 11, 2015 Author ID:938561 Share Posted February 11, 2015 Kevin,No issues that I can tell. Thank you for your help !Sharon Link to post Share on other sites More sharing options...
kevinf80 Posted February 11, 2015 ID:938612 Share Posted February 11, 2015 Thanks for the update, run the following to clean up: Download "Delfix by Xplode" and save it to your desktop. Or use the following if first link is down: "Delfix link mirror" Double Click to start the program. If you are using Vista or higher, please right-click and choose run as administrator Make Sure the following items are checked: Remove disinfection tools Purge System Restore Reset system settings Now click on "Run" and wait patiently until the tool has completed. The tool will create a log when it has completed. We don't need you to post this. Any remnant files/logs from tools we have used can be deleted… Next, Read the following link to fully understand PC security and best practices, you may find it useful.... http://www.bleepingcomputer.com/forums/t/407147/answers-to-common-security-questions-best-practices/#entry2316629 Let me know if we are ok to close out... Thank you, Kevin.. Link to post Share on other sites More sharing options...
Root Admin AdvancedSetup Posted February 17, 2015 Root Admin ID:940480 Share Posted February 17, 2015 Due to the lack of feedback this topic is closed to prevent others from posting here. If you need this topic reopened, please send a Private Message to any one of the moderating team members. Please include a link to this thread with your request. This applies only to the originator of this thread. Other members who need assistance please start your own topic in a new thread. Thanks! Link to post Share on other sites More sharing options...
Recommended Posts