Malwarebytes not detecting possible Trojan

Doirse · August 23, 2015

Hello --

I am a malwarebytes premium owner, and also have Symantec Endpoint Protection. Starting a few weeks ago Symantec started catching a series of files with a "risk" of Trojan.Gen.2, and PUA.Wajam. At first it was only catching one or two files every few days, but a few days ago it started catching dozens (close to a hundred) of files a day. I have run full scans using both Symantec and Malwarebytes Anti-malware premium running the computer in both regular mode and safe mode, but neither program has detected anything (and all databases are up to date).

Following the instructions here (https://forums.malwarebytes.org/index.php?/topic/9573-im-infected-what-do-i-do-now/) I downloaded and ran the Farbar Recovery Scan Tool. The output of the FRST and Addition files are pasted below. Please let m know if you need any additional information, and thank you in advance for any help!!

(NOTE: I tried to copy/paste the contents of FRST and Addition directly into this post, per the instructions in the link above, but received an error message that the post is too long. Both files are now attached to the post)

Addition.txt

FRST.txt

TwinHeadedEagle · August 23, 2015

Hello,

They call me TwinHeadedEagle around here, and I'll try to help your with your issue.

Before we start please read and note the following:

We're primarily oriented on malware removal here, so you must know that some issues just cannot be solved and you must be prepared for this. Some tools we use here will remove your browser search history, so backup your important links and all the files whose loss is unacceptable.
Note that we may live in totally different time zones, what may cause some delays between answers.
Don't run any scripts or tools on your own, unsupervised usage may cause more harm than good.
Do not paste the logs in your posts, attachments make my work easier. There is a More reply options button, that gives you Upload Files option below which you can use to attach your reports. Always attach reports from all tools.
Always execute my instructions in given order. If for some reason you cannot completely follow one instruction, inform me about that.
If I don't hear from you within 3 days from this initial or any subsequent post, then this thread will be closed.

I can't foresee everything, so if anything not covered in my instructions happens, please stop and inform me!

There are no silly questions. Never be afraid to ask if in doubt!

Rules and policies

We won't support any piracy.

That being told, if any evidence of illegal OS, software, cracks/keygens or any other will be revealed, any further assistance will be suspended. If you are aware that there is this kind of stuff on your machine, remove it before proceeding!

The same applies to any use of P2P software: uTorrent, BitTorrent, Vuze, Kazaa, Ares... We don't provide any help for P2P, except for their removal. All P2P software has to be uninstalled or at least fully disabled before proceeding!

Failure to follow these guidelines will result with closing your topic and withdrawning any assistance.

Multiple Resident Protection warning!

Always have one (and no more than one!) AntiVirus program! In this case having more of them will not provide you with better protection - instead they may cause slowness, lock-ups and even mark another ones as harmful, leading to leave your system unstable and even damaged. Please choose only one from the listed below to stay with and uninstall the others:

Symantec Endpoint Protecton
Microsoft Security Essentials

Uninstallation procedure:

Press the + R on your keyboard at the same time. Type appwiz.cpl and click OK.
Search for each uninstalled entry, right-click it and select Uninstall.

This should be done until any other steps will be taken.

Scan with ZOEK

Please download ZOEK by Smeenk and save it to your desktop (preferred version is the *.exe one)

Temporary disable your AntiVirus and AntiSpyware protection - instructions here.

Right-click on icon and select Run as Administrator to start the tool.
Wait patiently until the main console will appear, it may take a minute or two.

In the main box please paste in the following script:

createsrpoint;autoclean;emptyalltemp;ipconfig /flushdns >>"%temp%\log.txt";b

Make sure that Scan All Users option is checked.
Push Run Script and wait patiently. The scan may take a couple of minutes.
When the scan completes, a zoek-results logfile should open in notepad.
If a reboot is needed, it will be opened after it. You may also find it at your main drive (usually C:\ drive)
Post its content into your next reply.

Doirse · August 23, 2015

Hi TwinHeadedEagle --

thank you for your help, and I understand there are limits to what is possible! Regarding the first two steps:

1. Multiple Resident Protection warning!

- I uninstalled Microsoft Security Essentials

2. Scan with ZOEK

- this step failed:

I was able to download and save the file. I right-clicked and selected 'Run As Administrator', then got a warning from Symantec about a user trying run as administrator, which I accepted, but then got the following error:

"wget.exe - Bad Image

C: Users\Dan\AppData\Local\Temp\PROPSYS.dll is either not designed to run on Windows or it contains an error. Try installing the program again using the original installation media or contact your system administrator or the software vendor for support."

Doirse · August 23, 2015

I tried running ZOEK again as administrator and I got the same symantec warning, but it opened this time. Should I go ahead and execute the script from above or wait for further instructions?

TwinHeadedEagle · August 23, 2015

Can you disable Symantec while running Zoek? They are known to block majority of removal tools with no legit reason.

Doirse · August 23, 2015

Can you disable Symantec while running Zoek? They are known to block majority of removal tools with no legit reason.

I just disabled Symantec and tried to 'run as administrator', but I got the same "wget.exe - bad image" as I did the first try.

Doirse · August 23, 2015

Despite the error message, Zoek still launched. Should I go ahead and execute the script?

TwinHeadedEagle · August 23, 2015

Yes, please do it.

Doirse · August 23, 2015

After about 30 seconds I got the following error message:

'Das21 has stopped working' Check online for a solution and close the program, or close the program

Problem signature:

Problem Event Name: CLR20r3

Problem Signature 01: das_21.exe

Problem Signature 02: 2.1.0.4

Problem Signature 03: 540c90b2

Problem Signature 04: mscorlib

Problem Signature 05: 4.0.30319.18444

Problem Signature 06: 52717d7e

Problem Signature 07: 314

Problem Signature 08: 22

Problem Signature 09: System.ArgumentOutOfRange

OS Version: 6.1.7601.2.1.0.768.3

Locale ID: 1033

Additional Information 1: b82e

Additional Information 2: b82ecfa40b678ebbe9bf12b812067c8e

Additional Information 3: 2b50

Additional Information 4: 2b5015aeb373f04dd73f4ef380361938

Read our privacy statement online:

http://go.microsoft.com/fwlink/?linkid=104288&clcid=0x0409

If the online privacy statement is not available, please read our privacy statement offline:

C:\Windows\system32\en-US\erofflps.txt

I waited another hour and Zoek did not finish. Should I stop it and restart, or do something else?

TwinHeadedEagle · August 23, 2015

Can you restart your PC and try again?

Doirse · August 23, 2015

it worked! Here are the results:

Zoek.exe v5.0.0.0 Updated 04-May-2015

Tool run by Dan on Sun 08/23/2015 at 17:49:01.71.

Microsoft Windows 7 Home Premium 6.1.7601 Service Pack 1 x64

Running in: Normal Mode Internet Access Detected

Launched: C:\Users\Dan\Documents\Malwarebytes Forum Help\Zoek\zoek.exe [scan all users] [script inserted]

==== Older Logs ======================

C:\zoek-results2015-08-23-205229.log 440 bytes

==== System Restore Info ======================

8/23/2015 5:56:35 PM Zoek.exe System Restore Point Created Successfully.

==== Empty Folders Check ======================

C:\Program Files\Symantec deleted successfully

C:\Users\Dan\AppData\Roaming\uTorrent deleted successfully

C:\Users\Dan\AppData\Local\EmieBrowserModeList deleted successfully

C:\Users\Dan\AppData\Local\EmieSiteList deleted successfully

C:\Users\Dan\AppData\Local\EmieUserList deleted successfully

C:\Users\Kenzie\AppData\Local\EmieBrowserModeList deleted successfully

C:\Users\Kenzie\AppData\Local\EmieSiteList deleted successfully

C:\Users\Kenzie\AppData\Local\EmieUserList deleted successfully

==== Deleting CLSID Registry Keys ======================

HKEY_USERS\S-1-5-21-3430297952-1085673760-3040505545-1000\Software\Microsoft\Internet Explorer\SearchScopes\{49C84E3A-71F5-4745-9DF9-3B3EA8AE8661} deleted successfully

HKEY_USERS\S-1-5-21-3430297952-1085673760-3040505545-1000\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{176F224F-07BF-4F3B-9899-C0E4A86B33D9} deleted successfully

HKEY_USERS\S-1-5-21-3430297952-1085673760-3040505545-1000\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{1CB06EBA-16CD-4C5C-857B-D0C819AAADCD} deleted successfully

HKEY_USERS\S-1-5-21-3430297952-1085673760-3040505545-1000\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{707CBDE1-6D68-442E-94C4-C3DE1A3DA88B} deleted successfully

HKEY_USERS\S-1-5-21-3430297952-1085673760-3040505545-1000\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{CFA2D85B-BF9E-4DA6-A6F8-ED9A3D351364} deleted successfully

==== Deleting CLSID Registry Values ======================

==== Deleting Services ======================

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SSUService deleted successfully

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\SSUService deleted successfully

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\splashtopremoteservice deleted successfully

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\splashtopremoteservice deleted successfully

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Control\SafeBoot\Network\splashtopremoteservice deleted successfully

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\splashtopremoteservice deleted successfully

==== FireFox Fix ======================

ProfilePath: C:\Users\Dan\AppData\Roaming\Mozilla\Firefox\Profiles\t4nvzln2.default

user.js not found

---- FireFox user.js and prefs.js backups ----

prefs_20150823_0619_.backup

ProfilePath: C:\Users\Eli\AppData\Roaming\Mozilla\Firefox\Profiles\wo8d1qr0.default

user.js not found

---- Lines search.com removed from prefs.js ----

user_pref("capability.policy.maonoscript.sites", "abcmouse.com addons.mozilla.org adobe.com adobedtm.com adobetag.com afx.ms ajax.aspnetcdn.com ajax.g

---- FireFox user.js and prefs.js backups ----

prefs_20150823_0619_.backup

ProfilePath: C:\Users\Kenzie\AppData\Roaming\Mozilla\Firefox\Profiles\8uhd0ujz.default

user.js not found

---- FireFox user.js and prefs.js backups ----

prefs_20150823_0619_.backup

ProfilePath: C:\Users\Sofia\AppData\Roaming\Mozilla\Firefox\Profiles\2v0ogqa6.default

user.js not found

---- Lines isearch removed from prefs.js ----

user_pref("weboftrust.search.avg.url", "^http(s)?\\:\\/\\/isearch\\.avg\\.com\\/search\\?");

---- Lines ask.com removed from prefs.js ----

user_pref("weboftrust.search.ask.display", "Ask.com Web Search");

---- Lines offers removed from prefs.js ----

user_pref("weboftrust.category.301", "{\"name\":\"301\",\"group\":\"4\",\"text\":\"Online tracking\",\"description\":\"Based on your experience the si

---- FireFox user.js and prefs.js backups ----

prefs_20150823_0619_.backup

==== Batch Command(s) Run By Tool======================

Windows IP Configuration

Successfully flushed the DNS Resolver Cache.

Sucessfully reset the Winsock Catalog.

You must restart the computer in order to complete the reset.

==== Deleting Files \ Folders ======================

C:\windows\SysNative\Tasks\{5F6010C8-60E5-41f3-BF5B-C3AF5DBE12D4} deleted

C:\PROGRA~2\The Weather Channel deleted

C:\PROGRA~2\Splashtop deleted

C:\install.exe deleted

C:\PROGRA~3\Splashtop deleted

C:\PROGRA~3\InstallMate deleted

C:\PROGRA~3\Package Cache deleted

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Shopping and Services deleted

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\lavasoft\WebCompanion deleted

C:\windows\SysNative\GroupPolicy\Machine deleted

C:\windows\SysNative\GroupPolicy\User deleted

C:\windows\SysNative\GroupPolicy\gpt.ini deleted

C:\Windows\SysWOW64\LavasoftTcpService.dll deleted

C:\Windows\SysWOW64\LavasoftTcpServiceOff.ini deleted

C:\Users\Dan\AppData\Roaming\Mozilla\Firefox\Profiles\t4nvzln2.default\extensions\trash\https-everywhere@eff.org deleted

C:\Users\Dan\AppData\Roaming\Mozilla\Firefox\Profiles\t4nvzln2.default\extensions\firefox@ghostery.com.xpi deleted

C:\Users\Dan\AppData\Roaming\Mozilla\Firefox\Profiles\t4nvzln2.default\jetpack deleted

C:\Users\Eli\AppData\Roaming\Mozilla\Firefox\Profiles\wo8d1qr0.default\extensions\firefox@ghostery.com.xpi deleted

C:\Users\Eli\AppData\Roaming\Mozilla\Firefox\Profiles\wo8d1qr0.default\jetpack deleted

C:\Users\Eli\AppData\Roaming\Mozilla\Firefox\Profiles\wo8d1qr0.default\extensions\staged deleted

C:\Users\Sofia\AppData\Roaming\Mozilla\Firefox\Profiles\2v0ogqa6.default\extensions\firefox@ghostery.com.xpi deleted

C:\Users\Sofia\AppData\Roaming\Mozilla\Firefox\Profiles\2v0ogqa6.default\jetpack deleted

C:\Users\Sofia\AppData\Roaming\Mozilla\Firefox\Profiles\2v0ogqa6.default\extensions\staged deleted

"C:\Windows\Installer\dfeef74.msi" deleted

"C:\Windows\Installer\4a3565.msi" deleted

"C:\PROGRA~3\Browser Manager" deleted

==== Firefox Start and Search pages ======================

ProfilePath: C:\Users\Dan\AppData\Roaming\Mozilla\Firefox\Profiles\t4nvzln2.default

user_pref("browser.startup.homepage", "https://www.malwarebytes.org/restorebrowser/");

user_pref("browser.search.defaultenginename", "Bing");

user_pref("browser.search.defaultenginename.US", "Google");

user_pref("browser.search.selectedEngine", "Bing");

ProfilePath: C:\Users\Eli\AppData\Roaming\Mozilla\Firefox\Profiles\wo8d1qr0.default

user_pref("browser.search.defaultenginename", "Google");

ProfilePath: C:\Users\Kenzie\AppData\Roaming\Mozilla\Firefox\Profiles\8uhd0ujz.default

user_pref("browser.search.defaultenginename.US", "Taplika");

ProfilePath: C:\Users\Sofia\AppData\Roaming\Mozilla\Firefox\Profiles\2v0ogqa6.default

user_pref("browser.search.defaultenginename", "Google");

==== Firefox Extensions Registry ======================

[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Mozilla\Firefox\Extensions]

"{DF153AFF-6948-45d7-AC98-4FC4AF8A08E2}"="C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\Firefox\Ext" [09/28/2013 10:29 AM]

==== Firefox Extensions ======================

ProfilePath: C:\Users\Dan\AppData\Roaming\Mozilla\Firefox\Profiles\t4nvzln2.default

- HTTPS-Everywhere - %ProfilePath%\extensions\https-everywhere@eff.org

- Undetermined - %ProfilePath%\extensions\trash

- WOT - %ProfilePath%\extensions\{a0d7ccb3-214d-498b-b4aa-0e8fda9a7bf7}

- NoScript - %ProfilePath%\extensions\{73a6fe31-595d-460b-a920-fcc0f8843232}.xpi

- Adblock Plus - %ProfilePath%\extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi

- BetterPrivacy em:version1.68.1-signed em:type2 em:creatorGreg Yardley version 0.2 www.yardley.ca em:descriptionquot - %ProfilePath%\extensions\{d40f5e7b-d2cf-4856-b441-cc613eeffbe3}.xpi