Jacketzod Posted October 29, 2015 ID:998538 Share Posted October 29, 2015 I believe that my explorer.exe has been compromised by a new version of Poweliks, every time I start up my computer after a few moments a large number of comhost and windows presentation processes show up in my process list and cause my CPU usage to skyrocket from 5% to 80%-99%. In my attempts to remove the malware I booted my computer in safe mode and found with some tinkering that the problems only happen when i run explorer.exe and connect to the internet. Ontop of this i have also noticed briefly upon shutting down my computer that advertisements will show up as the computer turns off, likely running in the background the entire time. At this time i believe that explorer.exe is the only compromised process as it is the only one that triggers the other programs. I decided to compare my computer's symptoms with reported malware and i think that Trojan.Poweliks is the most likely culprit. I decided to try and run avast, i found that avast refuses to open. So I went and downloaded the installer for Malwarebytes and found that upon running the installer it would simply refuse to start the installation process, no error code or anything, it just wouldn't run. Next I looked on the forums to try and figure out how to get MBAM to install, found a topic saying that chameleon would work, it didn't. After that i tried getting ADW cleaner, it ran just fine but couldn't detect any problems, should've figured as much in hindsight as this is a rootkit infection. Having exhausted these options i found Malwarebytes Anti-Rootkit BETA and decided it was worth a shot, like with MBAM, MBAR wouldn't run. So here i am hoping that someone can help me finally get rid of this thing, it's been on my computer since yesterday and i just want it gone. Thank you for taking the time to help Link to post Share on other sites More sharing options...
Jacketzod Posted October 29, 2015 Author ID:998539 Share Posted October 29, 2015 I should also add that I am the admin for my computer and that before this infection I have never had problems with programs not opening Link to post Share on other sites More sharing options...
kevinf80 Posted October 29, 2015 ID:998563 Share Posted October 29, 2015 Hello and welcome,P2P/Piracy Warning: If you're using Peer 2 Peer software such as uTorrent, BitTorrent or similar you must either fully uninstall them or completely disable them from running while being assisted here.Failure to remove or disable such software will result in your topic being closed and no further assistance being provided.If you have illegal/cracked software, cracks, keygens etc. on the system, please remove or uninstall them now and read the policy on Piracy. Next, Please download RogueKiller and save it to your desktop from the following link: http://www.bleepingcomputer.com/download/roguekiller/ Quit all running programs.For Windows XP, double-click to start.For Vista,Windows 7/8/8.1/10, Right-click on the program and select Run as Administrator to start and when prompted allow it to run.Read and accept the EULA (End User Licene Agreement)Click Scan to scan the system.When the scan completes select "Report",in the next window select "Export txt" the log will open as a text file post that log... Also save to your Desktop for reference. log will open.Close the program > Don't Fix anything! If RogueKiller will not run try renaming to explorer.exe Thanks, Kevin.. Link to post Share on other sites More sharing options...
Jacketzod Posted October 29, 2015 Author ID:998579 Share Posted October 29, 2015 Rougekiller wont run, tried renaming to explorer.exe, still nothingTried running it through task mannager, nothing. Link to post Share on other sites More sharing options...
Jacketzod Posted October 29, 2015 Author ID:998600 Share Posted October 29, 2015 okay so i followed some instructions someone else gave and i donwloaded dr webfixitit's the only one i was able to run and it said it detected trojan.mayachok.5 in HDD0 partition 1 Link to post Share on other sites More sharing options...
Jacketzod Posted October 29, 2015 Author ID:998601 Share Posted October 29, 2015 HDD0: MBR - OkHDD0 Partition1: Active MBR NTFS\exFAT partition - infected with Trojan.Mayachok.5HDD0 Partition1: Active MBR NTFS\exFAT partition - infectedHDD0 Partition2: MBR NTFS\exFAT partition - OkHDD0 Partition3: MBR NTFS\exFAT partition - OkHDD1: MBR - OkHDD1 Partition1: MBR NTFS\exFAT partition - OkTotal 0 bytes in 0 files scanned (6 objects)Total 5 files are cleanTotal 0 files (1 object) is infectedScan time is 00:00:00.082-----------------------------------------------------------------------------Start curing-----------------------------------------------------------------------------HDD0 Partition1: Active MBR NTFS\exFAT partition - infected, write errorTotal 0 bytes in 0 files scanned (6 objects)Total 5 files are cleanTotal 0 files (1 object) is infectedTotal 1 file is raised error conditionScan time is 00:00:00.082 Link to post Share on other sites More sharing options...
Jacketzod Posted October 29, 2015 Author ID:998607 Share Posted October 29, 2015 do you know how i can remove it?because webcureit seems to be unable to remove it Link to post Share on other sites More sharing options...
kevinf80 Posted October 29, 2015 ID:998613 Share Posted October 29, 2015 I have not got a clue what drwebfixit is?? Download TDSSKiller and save it to your Desktop.Make sure TDSSKiller.exe is on the Desktop itself, not within a folder on the desktop.Go to Start > Run (Or you can hold down your Windows key and press R) and copy and paste the following into the text field. (make sure you include the quote marks) Then press OK."%userprofile%\Desktop\TDSSKiller.exe" -l C:\TDSSKiller.txtIf it says "Hidden service detected" DO NOT type anything in. Just press Enter on your keyboard to not do anything to the file.If Malicious objects are found, do NOT select Delete or Cure. Change the action to Skip, When it is done, a log file should be created on your C: drive called "TDSSKiller.txt" please copy and paste the contents of that file here. Link to post Share on other sites More sharing options...
Jacketzod Posted October 29, 2015 Author ID:998621 Share Posted October 29, 2015 it wont run, the only thing that has run is doctor web cure it and that can't fix the problem it detects because it can't edit the partition Link to post Share on other sites More sharing options...
Jacketzod Posted October 29, 2015 Author ID:998622 Share Posted October 29, 2015 nothing works, should i just format my hard drive? Link to post Share on other sites More sharing options...
kevinf80 Posted October 29, 2015 ID:998624 Share Posted October 29, 2015 Try the following: Download Farbar Recovery Scan Tool and save it to your desktop.Note: You need to run the version compatible with your system (32 bit or 64 bit). If you are not sure which version applies to your system download both of them and try to run them. Only one of them will run on your system, that will be the right version.Double-click to run it. When the tool opens click Yes to disclaimer.(Windows 8 users will be prompted about Windows SmartScreen protection - click More information and Run.) Press Scan button to run the tool.... It will make a log (FRST.txt) in the same directory the tool is run. Please copy and paste it to your reply. The first time the tool is run, it makes also another log (Addition.txt). Please attach it to your reply.Next,Download Listparts from here: http://www.bleepingcomputer.com/download/listparts/ Make sure t get the correct version...Run the tool, click Scan and post the log (Result.txt) it makes. Link to post Share on other sites More sharing options...
Jacketzod Posted October 30, 2015 Author ID:998626 Share Posted October 30, 2015 Addition.txtFRST.txt Link to post Share on other sites More sharing options...
Jacketzod Posted October 30, 2015 Author ID:998627 Share Posted October 30, 2015 Result.txtand this one, sorry forgot to put in last post Link to post Share on other sites More sharing options...
kevinf80 Posted October 30, 2015 ID:998638 Share Posted October 30, 2015 Download attached fixlist.txt file (end of reply) and save it to the Desktop, or the folder you saved FRST into.NOTE. It's important that both FRST and fixlist.txt are in the same location or the fix will not work.Run FRST and press the Fix button just once and wait.The tool will make a log on the Desktop (Fixlog.txt) or the folder it was ran from. Please post it to your reply. Next, Please open Malwarebytes Anti-Malware. On the Settings tab > Detection and Protection sub tab, Detection Options, tick the box "Scan for rootkits".Under Non-Malware Protection sub tab Change PUP and PUM entries to Treat detections as MalwareClick on the Scan tab, then click on Scan Now >> . If an update is available, click the Update Now button.A Threat Scan will begin.With some infections, you may or may not see this message box. 'Could not load DDA driver'Click 'Yes' to this message, to allow the driver to load after a restart.Allow the computer to restart. Continue with the rest of these instructions.When the scan is complete, click Apply Actions.Wait for the prompt to restart the computer to appear, then click on Yes.After the restart once you are back at your desktop, open MBAM once more.To get the log from Malwarebytes do the following: Click on the History tab > Application Logs.Double click on the scan log which shows the Date and time of the scan just performed.Click Export > From export you have three options: Copy to Clipboard - if seleted right click to your reply and select "Paste" log will be pasted to your reply Text file (*.txt) - if selected you will have to name the file and save to a place of choice, recommend "Desktop" then attach to reply XML file (*.xml) - if selected you will have to name the file and save to a place of choice, recommend "Desktop" then attach to replyPlease use "Copy to Clipboard, then Right click to your reply > select "Paste" that will copy the log to your reply…If Malwarebytes is not installed follow these instructions first:Download Malwarebytes Anti-Malware to your desktop.Double-click mbam-setup and follow the prompts to install the program.At the end, be sure a checkmark is placed next to the following:Launch Malwarebytes Anti-MalwareA 14 day trial of the Premium features is pre-selected. You may deselect this if you wish, and it will not diminish the scanning and removal capabilities of the program.Click Finish. Follow the instructions above.... Post those logs, also give an update on any remaining issues or concerns.. KevinFixlist.txt Link to post Share on other sites More sharing options...
Jacketzod Posted October 30, 2015 Author ID:998646 Share Posted October 30, 2015 I did as you said for the first part and it seems as though explorer isn't opening the background ads anymore, however i am still unable to run the installer for malwarebytesFixlog.txtthis is the txt file it made after running as you requested, have any ideas on how to force the installer? Link to post Share on other sites More sharing options...
kevinf80 Posted October 30, 2015 ID:998713 Share Posted October 30, 2015 (edited) Download Services Repair tool, available here - http://kb.eset.com/library/ESET/KB%20Team%20Only/Malware/ServicesRepair.exe and Save it to your Desktop. Right click on it and select Run As Administrator, follow the prompts. It should reboot when it finishes. If not reboot it yourself. Next, Go here: xxxx link removed xxxx Download the clean up tool for Malwarebytes to your Desktop. Run that tool twice, reboot after each run. See if Malwarebytes will now install... Thanks, Kevin Post updated [02/12/2021 - AdvancedSetup] The following MBST tool should be used to perform a clean removal and reinstall https://support.malwarebytes.com/hc/en-us/articles/360039023473-Uninstall-and-reinstall-using-the-Malwarebytes-Support-Tool Edited February 13, 2021 by AdvancedSetup updated information Link to post Share on other sites More sharing options...
Jacketzod Posted October 30, 2015 Author ID:998776 Share Posted October 30, 2015 i ran the first one you sent me "services repair" and it worked but mbam clean wont run Link to post Share on other sites More sharing options...
kevinf80 Posted October 30, 2015 ID:998782 Share Posted October 30, 2015 Download RKill from here: http://www.bleepingcomputer.com/download/rkill/There are three buttons to choose from with different names on, select the first one and save it to your desktop. Double-click on the Rkill desktop icon to run the tool. If using Vista or Windows 7/8, right-click on it and Run As Administrator. A black DOS box will briefly flash and then disappear. This is normal and indicates the tool ran successfully. A log pops up at the end of the run. This log file is located at C:\rkill.log. Please post this in your next reply. If you do not see the black box flash on the screen delete the icon from the desktop and go back to the link for the download, select the next button and try to run the tool again, continue to repeat this process using the remaining buttons until the tool runs. You will find further links if you scroll down the page with other names, try them one at a time. If the tool does not run from any of the links provided, please let me know. Let me see that log, also see if malwarebytes will now install... Link to post Share on other sites More sharing options...
Jacketzod Posted October 30, 2015 Author ID:998825 Share Posted October 30, 2015 Did as you requested and none of them ran, tried running installer as well and it still wont run.Tried each one and none of them even poped up in the processes list or applications in Task Manager. Link to post Share on other sites More sharing options...
kevinf80 Posted October 30, 2015 ID:998829 Share Posted October 30, 2015 Run FRST one more time, ensure all boxes are checkmarked under "Whitelist" but only Addition.txt under "Optional scan" Select scan, when done post the two logs.... Link to post Share on other sites More sharing options...
Jacketzod Posted October 30, 2015 Author ID:998836 Share Posted October 30, 2015 it's terminating FRST now.i ran FRST and it showed up in my processes for 2 seconds and then stopped Link to post Share on other sites More sharing options...
Jacketzod Posted October 30, 2015 Author ID:998837 Share Posted October 30, 2015 okay, i downloaded a new FRST from the link you sent before and the new one is working Link to post Share on other sites More sharing options...
Jacketzod Posted October 30, 2015 Author ID:998838 Share Posted October 30, 2015 Addition.txtFRST.txt here are the new files from the scan Link to post Share on other sites More sharing options...
kevinf80 Posted October 30, 2015 ID:998847 Share Posted October 30, 2015 Download attached fixlist.txt file (end of reply) and save it to the Desktop, or the folder you saved FRST into.NOTE. It's important that both FRST and fixlist.txt are in the same location or the fix will not work.Run FRST and press the Fix button just once and wait.The tool will make a log on the Desktop (Fixlog.txt) or the folder it was ran from. Please post it to your reply. Next, Please download RogueKiller and save it to your desktop from the following link: http://www.bleepingcomputer.com/download/roguekiller/Rename to userinit.exeQuit all running programs. For Windows XP, double-click to start. For Vista,Windows 7/8/8.1/10, Right-click on the program and select Run as Administrator to start and when prompted allow it to run. Read and accept the EULA (End User Licene Agreement) Click Scan to scan the system. When the scan completes select "Report",in the next window select "Export txt" the log will open as a text file post that log... Also save to your Desktop for reference. log will open. Close the program > Don't Fix anything! Post those logs, Fixlist.txt Link to post Share on other sites More sharing options...
Jacketzod Posted November 2, 2015 Author ID:999269 Share Posted November 2, 2015 still can't run rougekiller, even after renaming to userinit.exeFixlog.txt Link to post Share on other sites More sharing options...
Recommended Posts