Nasty Malware, MBAR won't work

[Stanczyk]

Hello. My computer's infected by something really stubborn that Malwarebytes Anti-Rootkit can't fix (it won't restart to install the DDA driver and can't scan.) The malware is causing all kinds of problems and I'd appreciate any help as I really don't want to wipe my computer and reinstall everything.

TYIA

[kevinf80]

Hello Stanczyk and welcome to Malwarebytes, Follow the instructions at this link and post the requested logs: https://forums.malwarebytes.com/topic/9573-im-infected-what-do-i-do-now/ Thank you, Kevin

[Stanczyk]

Thanks for the prompt reply.

Addition.txt

FRST.txt

mwbLog.txt

[kevinf80]

Thanks for those logs, continue please:

Uninstall Spybot S&D https://www.safer-networking.org/faq/how-to-uninstall-2/

Next,

Download attached fixlist.txt file (end of reply) and save it to the Desktop, or the folder you saved FRST into. "Do not open that file"
NOTE. It's important that both FRST and fixlist.txt are in the same location or the fix will not work.

Open FRST and press the Fix button just once and wait.
The tool will make a log on the Desktop (Fixlog.txt) or the folder it was ran from. Please post it to your reply.

Also do you have access to a USB flash drive, you will need one to run a fix from Recovery Environment in the next stage...

Thank you,

Kevin

fixlist.txt

[Stanczyk]

Spybot is now uninstalled, and I have a USB flash drive on hand.

Fixlog.txt

[kevinf80]

Thanks for the update and log.... Continue as follows:

Please download Farbar Recovery Scan Tool from here: http://www.bleepingcomputer.com/download/farbar-recovery-scan-tool/ save it to a USB flash drive. Ensure to get the correct version for your system, 32 bit or 64 bit... Also download attached fixlist.txt file (end of reply) and save it to the same USB flash drive. Next, From your Desktop select the start Flag (bottom lefthand corner of screen) Hold down the "Shift key" of your keyboard, keep it down and select "Restart" Your PC should open to the "Choose an Option" window.... release shift key. From that window select "Troubleshoot" From the next window select "Advance Options" From that Window select "Command Prompt" Ensure to plug the flash drive into a USB port... You should now be in Recovery Environment with the Command Prompt Window open...... Continue with the following:   In the command window type in notepad and press Enter. The notepad opens. Under File menu select Open. Select "This PC" and find your flash drive letter and close the notepad. In the command window type E:\frst64 or E:\frst depending on your version. Press Enter Note: Replace letter E with the drive letter of your flash drive. <<<----vey important The tool will start to run. When the tool opens click Yes to disclaimer. Press Fix button just once and wait. FRST will run make a log (fixlog.txt) on the flash drive. You will need to boot back to Normal windows to post the log, or if applicable do that action from a spare PC... To boot back to windows, type exit at the prompt and hit enter Please copy and paste or attach FRST log to your reply. Thanks, Kevin...

fixlist.txt

[Stanczyk]

My PC doesn't open to the "Choose an Option" window while I hold the shift key, and just restarts normally.

I've also tried using the 'Restart Now' button in the 'Update & Security' settings window, and the shutdown /r /o command. None work.

Edited September 12, 2017 by Stanczyk

[kevinf80]

Run FRST fix one more time, when complete try the fix from recovery environment again... It would seem that RE environment is still disabled

Download attached fixlist.txt file (end of reply) and save it to the Desktop, or the folder you saved FRST into. "Do not open that file"
NOTE. It's important that both FRST and fixlist.txt are in the same location or the fix will not work.

Open FRST and press the Fix button just once and wait.
The tool will make a log on the Desktop (Fixlog.txt) or the folder it was ran from. Please post it to your reply.

 

fixlist.txt

[Stanczyk]

It still won't work.

I have a Windows 10 Recovery DVD. I can try to access Advanced Options during boot, if it makes any difference.

Fixlog.txt

[kevinf80]

Yes you can boot from DVD and access recovery environment that way.... Can you manage ok...?

[Stanczyk]

Yes, I'll try and follow your instructions from post #6 if it works.

[kevinf80]

If you are successful with the RE fix boot back to normal windows and run a threat scan with Malwarebytes...... Post all logs.. Its getting late for me, i`ll be offline soon...

 

[Stanczyk]

Fixlog.txt

mwbtLOG.txt

 

[kevinf80]

From the malwarebytes log it shows the infection has returned, we need to start over and recheck the logs..... Continue please:

Run FRST one more time, ensure all boxes are checkmarked under "Whitelist" but only Addition.txt under "Optional scan" Select scan, when done post the new logs. "FRST.txt" and "Addition.txt"

Next,

Download attached fixlist.txt file (end of reply) and save it to the Desktop, or the folder you saved FRST into. "Do not open that file"
NOTE. It's important that both FRST and fixlist.txt are in the same location or the fix will not work.

Open FRST and press the Fix button just once and wait.
The tool will make a log on the Desktop (Fixlog.txt) or the folder it was ran from. Please post it to your reply.

In your reply show these logs:

FRST.txt

Addition.txt

Fixlog.txt

 

 

 

fixlist.txt

[Stanczyk]

FRST.txt

Addition.txt

Fixlog.txt

[kevinf80]

Thanks for those logs, I want you to run another FRST fix via the recovery environment. Boot to the RE as you did before from the Windows 10 Recovery DVD.

Download and save the attached file fixlist.txt (end of reply) and save it to your USB Flashdrive alongside FRST. plug into your PC...

Boot to the Choose an Option Window:

From that window select "Troubleshoot" From the next window select "Advance Options" From that Window select "Command Prompt" Ensure to plug the flash drive into a USB port... You should now be in Recovery Environment with the Command Prompt Window open...... Continue with the following:   In the command window type in notepad and press Enter. The notepad opens. Under File menu select Open. Select "Computer" and find your flash drive letter and close the notepad. In the command window type E:\frst64 or E:\frst depending on your version. Press Enter Note: Replace letter E with the drive letter of your flash drive. <<<----vey important The tool will start to run. When the tool opens click Yes to disclaimer. Press Fix button just once and wait. FRST will run make a log (fixlog.txt) on the flash drive. You will need to boot back to Normal windows to post the log, or if applicable do that action from a spare PC... To boot back to windows, type exit at the prompt and hit enter Please copy and paste or attach fixlog.txt to your reply. Next, Boot back to normal windows, see if MBAR will run... Thanks, Kevin...

fixlist.txt

[Stanczyk]

Fixlog.txt

MBAR doesn't work. I get these messages:

"The DDA driver was not installed which may be caused by rootkit activity. Do you want to reboot the computer to install DDA driver (Scan will continue after reboot)?"

After I click OK to reboot, nothing happens and get this message:

"Could not install driver on boot. Scan can't continue"

 

I've noticed something that may or may not be relevant. Since this infection happened I've noticed some unusual activity upon Windows startup - I hear a few Win 10 'beeps,' and a blank application starts running (visible in the toolbar) which immediately disappears. After running the FRST fix from the Recovery Environment, the activity didn't occur until the computer was restarted. It is also absent this time.

[kevinf80]

Run FRST fix again, I want to check if the malicious driver has not been moved....

Download attached fixlist.txt file (end of reply) and save it to the Desktop, or the folder you saved FRST into. "Do not open that file"
NOTE. It's important that both FRST and fixlist.txt are in the same location or the fix will not work.

Open FRST and press the Fix button just once and wait.
The tool will make a log on the Desktop (Fixlog.txt) or the folder it was ran from. Please post it to your reply.

Next,

Run FRST one more time, ensure all boxes are checkmarked under "Whitelist" but only Addition.txt under "Optional scan" Select scan, when done post the new logs. "FRST.txt" and "Addition.txt"

Post those logs, i`ll check if problem driver is still installed...

 

fixlist.txt

[Stanczyk]

FRST did something by itself as soon as I ran it (scheduled fix?)

Fixlog.txt

(I haven't done anything yet but start up FRST)

Edited September 13, 2017 by Stanczyk

[kevinf80]

The problem driver has just been mashed, can you try MBAR...

[Stanczyk]

Same error in MBAR as before. Should I reboot?

Edited September 13, 2017 by Stanczyk

[kevinf80]

Can you run what I posted in reply #18, lets see if the problem driver is definitely gone

[Stanczyk]

Fixlog.txt

FRST.txt

Addition.txt

[kevinf80]

I do not see any evidence of the problem driver, run the following from normal windows:

Download attached fixlist.txt file (end of reply) and save it to the Desktop, or the folder you saved FRST into. "Do not open that file"
NOTE. It's important that both FRST and fixlist.txt are in the same location or the fix will not work.

Open FRST and press the Fix button just once and wait.
The tool will make a log on the Desktop (Fixlog.txt) or the folder it was ran from. Please post it to your reply.

Next,

Please open Malwarebytes Anti-Malware.   On the Settings tab > Detection and Protection sub tab, Detection Options, tick the box "Scan for rootkits". Under Non-Malware Protection sub tab Change PUP and PUM entries to Treat detections as Malware Click on the Scan tab, then click on Scan Now >> . If an update is available, click the Update Now button. A Threat Scan will begin. When the Scan is complete Apply Actions to any found entries. Wait for the prompt to restart the computer to appear (if applicable), then click on Yes. After the restart once you are back at your desktop, open MBAM once more. To get the log from Malwarebytes do the following:   Click on the Report tab > from main interface. Double click on the Scan log which shows the Date and time of the scan just performed. Click Export > From export you have two options: Copy to Clipboard - if seleted right click to your reply and select "Paste" log will be pasted to your reply Text file (*.txt) - if selected you will have to name the file and save to a place of choice, recommend "Desktop" then attach to reply   Please use "Copy to Clipboard, then Right click to your reply > select "Paste" that will copy the log to your reply… Let me see those logs... Kevin

fixlist.txt

[Stanczyk]

My version of Malware bytes is a little different and I couldn't change this:

> Under Non-Malware Protection sub tab Change PUP and PUM entries to Treat detections as Malware

I only have 'Ignore,' 'Warn,' and 'Always detect PUPs' / 'Always detect PUMs' as options. I left the options with 'Always detect' and went on ahead.

 

 

Fixlog.txt

 

Fix result of Farbar Recovery Scan Tool (x64) Version: 13-09-2017 02
Ran by List (13-09-2017 18:14:42) Run:8
Running from C:\Users\List\Desktop\FINALFIX\_1
Loaded Profiles: List (Available Profiles: List)
Boot Mode: Normal
==============================================

fixlist content:
*****************
Start
CloseProcesses:
CreateRestorePoint:
HKU\S-1-5-21-2489865123-2485827485-1206147462-1001\...\Run: [forgetful] => "C:\Program Files (x86)\siberians\forgetful.exe"
C:\Program Files (x86)\siberians
HKU\S-1-5-21-2489865123-2485827485-1206147462-1001\...\Run: [tunic] => "C:\Program Files (x86)\Repost\hollis.exe"
C:\Program Files (x86)\Repost
Tcpip\Parameters: [NameServer] 8.8.8.8
Tcpip\..\Interfaces\{b96ff770-e5e0-47a7-9a82-891f76def716}: [NameServer] 8.8.8.8
S2 SpyHunter 4 Service; "C:\Program Files\Enigma Software Group\SpyHunter\Sh4Service.exe" [X]
S3 WsDrvInst; "C:\Program Files (x86)\Aimersoft\iTube Studio\DriverInstall.exe" [X]
S3 esgiguard; \??\C:\Program Files\Enigma Software Group\SpyHunter\esgiguard.sys [X]
C:\WINDOWS\system32\Drivers\terehknr.sys
C:\Users\List\AppData\Local\unikrpc
C:\WINDOWS\b65036460
2017-09-12 17:08 - 2016-08-30 14:39 - 000000000 ____D C:\ProgramData\Spybot - Search & Destroy
2017-09-12 17:08 - 2016-08-30 14:39 - 000000000 ____D C:\Program Files (x86)\Spybot - Search & Destroy 2
Task: {96A71E4B-30FF-4740-BC72-5A10F2005DE3} - \OfficeSoftwareProtectionPlatform\SvcRestartTask -> No File <==== ATTENTION
CMD: ipconfig /flushdns
EmptyTemp:
end

*****************

Processes closed successfully.
Error: (0) Failed to create a restore point.
HKU\S-1-5-21-2489865123-2485827485-1206147462-1001\Software\Microsoft\Windows\CurrentVersion\Run\\forgetful => value removed successfully
"C:\Program Files (x86)\siberians" => not found.
HKU\S-1-5-21-2489865123-2485827485-1206147462-1001\Software\Microsoft\Windows\CurrentVersion\Run\\tunic => value removed successfully
"C:\Program Files (x86)\Repost" => not found.
HKLM\System\CurrentControlSet\Services\Tcpip\Parameters\\NameServer => value removed successfully
HKLM\System\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{b96ff770-e5e0-47a7-9a82-891f76def716}\\NameServer => value removed successfully
HKLM\System\CurrentControlSet\Services\SpyHunter 4 Service => key removed successfully
SpyHunter 4 Service => service removed successfully
HKLM\System\CurrentControlSet\Services\WsDrvInst => key removed successfully
WsDrvInst => service removed successfully
HKLM\System\CurrentControlSet\Services\esgiguard => key removed successfully
esgiguard => service removed successfully
Could not move "C:\WINDOWS\system32\Drivers\terehknr.sys" => Scheduled to move on reboot.

"C:\Users\List\AppData\Local\unikrpc" folder move:

Could not move "C:\Users\List\AppData\Local\unikrpc" => Scheduled to move on reboot.

Could not move "C:\WINDOWS\b65036460" => Scheduled to move on reboot.
C:\ProgramData\Spybot - Search & Destroy => moved successfully
C:\Program Files (x86)\Spybot - Search & Destroy 2 => moved successfully
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{96A71E4B-30FF-4740-BC72-5A10F2005DE3} => key removed successfully
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{96A71E4B-30FF-4740-BC72-5A10F2005DE3} => key removed successfully
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\OfficeSoftwareProtectionPlatform\SvcRestartTask => key removed successfully

========= ipconfig /flushdns =========

Windows IP Configuration

Successfully flushed the DNS Resolver Cache.

========= End of CMD: =========

=========== EmptyTemp: ==========

BITS transfer queue => 7364608 B
DOMStore, IE Recovery, AppCache, Feeds Cache, Thumbcache, IconCache => 42137127 B
Java, Flash, Steam htmlcache => 235981692 B
Windows/system/drivers => 437149 B
Edge => 5845418 B
Chrome => 0 B
Firefox => 433530941 B
Opera => 0 B

Temp, IE cache, history, cookies, recent:
Default => 0 B
Users => 0 B
ProgramData => 0 B
Public => 0 B
systemprofile => 128 B
systemprofile32 => 128 B
LocalService => 37722 B
NetworkService => 22982 B
List => 745696544 B

RecycleBin => 687059 B
EmptyTemp: => 1.4 GB temporary data Removed.

================================

Result of scheduled files to move (Boot Mode: Normal) (Date&Time: 13-09-2017 18:20:01)

C:\WINDOWS\system32\Drivers\terehknr.sys => Is moved successfully
"C:\Users\List\AppData\Local\unikrpc" => Could not move
C:\WINDOWS\b65036460 => Is moved successfully

==== End of Fixlog 18:20:38 ====

 

 

 

Malwarebytes
www.malwarebytes.com

-Log Details-
Scan Date: 9/13/17
Scan Time: 6:31 PM
Log File: 459bc7e8-98d3-11e7-a3bf-d017c2d264b1.json
Administrator: Yes

-Software Information-
Version: 3.2.2.2018
Components Version: 1.0.188
Update Package Version: 1.0.2797
License: Trial

-System Information-
OS: Windows 10 (Build 15063.540)
CPU: x64
File System: NTFS
User: DESKTOP-HO5U8KA\List

-Scan Summary-
Scan Type: Threat Scan
Result: Completed
Objects Scanned: 426347
Threats Detected: 1
Threats Quarantined: 0
(No malicious items detected)
Time Elapsed: 1 min, 38 sec

-Scan Options-
Memory: Enabled
Startup: Enabled
Filesystem: Enabled
Archives: Enabled
Rootkits: Enabled
Heuristics: Enabled
PUP: Detect
PUM: Detect

-Scan Details-
Process: 0
(No malicious items detected)

Module: 0
(No malicious items detected)

Registry Key: 0
(No malicious items detected)

Registry Value: 0
(No malicious items detected)

Registry Data: 0
(No malicious items detected)

Data Stream: 0
(No malicious items detected)

Folder: 0
(No malicious items detected)

File: 1
Rootkit.Agent.PUA, C:\WINDOWS\System32\drivers\terbehko.sys, Removal Failed, [6015], [427182],0.0.0

Physical Sector: 0
(No malicious items detected)

(end)

Edited September 13, 2017 by Stanczyk