Ransomware - Trojan.Agent.ED, Trojan.Dorkbot.ED etc

[TwinHeadedEagle]

Can you try to scan this file on VirusTotal?

 

https://www.virustotal.com/

 

Choose Reanalyze.

[Davexxx]

VirusTotal scan:

File name: OatboSratl.fox
Detection ratio: 20 / 57  
Analysis date: 2015-02-14 12:18:26 UTC ( 0 minutes ago )  
 

Dave.

[TwinHeadedEagle]

Can you post the link please?

[Davexxx]

https://www.virustotal.com/en/file/8eb1d073516485ee9e0d079f7e33c17e7d63c68f2eadeb1c8b3138b1867fc21e/analysis/1423917074/

 

Dave

[TwinHeadedEagle]

FRST search
 
Once again we shall use FRST for additional checks. Re-run FRST/FRST64 by double-clicking:

• Copy ApnUpdater;GoluKfid into the Search: field in FRST then click the Search Registry button.
• FRST will search your computer for files and when finished it will produce a log Search.txt in the same directory the tool is run.
• Please attach it to your reply.

[Davexxx]

FRST Search.txt attached.

 

Dave.

Search.txt

[TwinHeadedEagle]

Fix with Farbar Recovery Scan Tool
 

This fix was created for this user for use on that particular machine.
Running it on another one may cause damage and render the system unstable.

 
Download attached fixlist.txt file and save it to the Desktop:
 
Both files, FRST and fixlist.txt have to be in the same location or the fix will not work!

• Right-click on icon and select Run as Administrator to start the tool.
  (XP users click run after receipt of Windows Security Warning - Open File).
• Press the Fix button just once and wait.
• If for some reason the tool needs a restart, please make sure you let the system restart normally. After that let the tool complete its run.
• When finished FRST will generate a log on the Desktop, called Fixlog.txt.

Please post it to your reply.
 

---

 
Fix with AdwCleaner
 
Please download AdwCleaner by Xplode and save the file to your Desktop.

• Right-click on icon and select Run as Administrator to start the tool.
• Wait until the database is updated.
• Accept the Terms of use and click Scan.
• When finished, please click Clean.
• Upon completion, click Report. A log (AdwCleaner[s*].txt) will open.

Please upload report in your reply.
 
Note: Reports will be saved in your system partition, usually at C:\Adwcleaner

fixlist.txt

[Davexxx]

FRST Fixlog.txt attached, plus AdwCleaner[s0].txt

Dave.

AdwCleanerS0.txt

Fixlog.txt

[TwinHeadedEagle]

Excellent. How is your PC now?

[Davexxx]

Superficially OK (nothing detected by Malwarebytes scan), but there are still two copies of OatboSratl.fox post-FRST fix at 15:58 (plus two in quarantine), see screenshot.

 

Dave.

[TwinHeadedEagle]

Quarantine is ok. Can you delete other two folders manually?

[Davexxx]

Yes - deleting C:\ProgramData\GoluKfid\ also deletes C:\Users\All Users\GoluKfid\

Dave.

[TwinHeadedEagle]

Is everything okay now?

[Davexxx]

1) Error message post-boot:

 

RegSvr32
The module "C:\ProgramData\GoluKfid\OatboSratl.fox" failed to load.
Make sure the binary is stored at the specified path or debug it to check for problems with the binary or dependent .DLL files.
The specified module could not be found.
 

2) Start-up includes:

 

Yes    HKCU:Run    GoluKfid    Microsoft Corporation    regsvr32.exe "C:\ProgramData\GoluKfid\OatboSratl.fox"

 

No trace of OatboSratl.fox apart from the two quarantine copies.

 

Dave.

[TwinHeadedEagle]

Scan with FRST again and attach fresh report.

[Davexxx]

I've just noticed that Malwarebytes Anti-Malware is missing from the 'Missing Icons' on the toolbar (VIPRE is there)

 

FRST scan files attached.

 

Dave.

Addition.txt

FRST.txt

[TwinHeadedEagle]

Fix with Farbar Recovery Scan Tool
 

This fix was created for this user for use on that particular machine.
Running it on another one may cause damage and render the system unstable.

 
Download attached fixlist.txt file and save it to the Desktop:
 
Both files, FRST and fixlist.txt have to be in the same location or the fix will not work!

• Right-click on icon and select Run as Administrator to start the tool.
  (XP users click run after receipt of Windows Security Warning - Open File).
• Press the Fix button just once and wait.
• If for some reason the tool needs a restart, please make sure you let the system restart normally. After that let the tool complete its run.
• When finished FRST will generate a log on the Desktop, called Fixlog.txt.

Please post it to your reply.

fixlist.txt

[Davexxx]

After FRST re-boot, Malwarebytes Anti-Malware is back again amongst the 'Missing Icons' on the toolbar.

 

FRST Fixlog.txt attached.

 

Dave.

Fixlog.txt

[TwinHeadedEagle]

I don't understand what Missing Icons means?

[Davexxx]

Apologies - for 'missing' read 'hidden', so Malwarebytes Anti-Malware is amongst the hidden icons (as expected).

 

Dave.

[TwinHeadedEagle]

How is your PC now?

[Davexxx]

Looks OK (MAM threat scan found nothing).

 

Dave.

[AdvancedSetup]

Glad we could help.

If you need this topic reopened, please send a Private Message to any one of the moderating team members. Please include a link to this thread with your request. This applies only to the originator of this thread.

Other members who need assistance please start your own topic in a new thread. Thanks!

[AdvancedSetup]

Topic reopened per request

[Davexxx]

Is a final tidy-up is still needed - e.g., to remove FRST logs/quarantines & delete 'system restore' backups still holding virus content ?

 

Dave.