Pablo Posted December 27, 2017 ID:1194954 Share Posted December 27, 2017 I scanned my pc with Mwb and I had numerous infections popup, the first time it was able to clear all but two. Both were rootkit.agent and the object type was registry key and registry value. I rebooted and tried again and this time it worked. However, everytime i reboot both the malware come back and shows up when i rescan. Furthermore if i use my pc a little and scan, it comes with the 2 rootkits and additional viruses. I have tried several programs but some of them arent even able to identify the rootkits. Any help would be appreciated. Thanks Link to post Share on other sites More sharing options...
kevinf80 Posted December 27, 2017 ID:1194969 Share Posted December 27, 2017 Hello Pablo and welcome to Malwarebytes, Follow the instructions at this link and post the requested logs: https://forums.malwarebytes.com/topic/9573-im-infected-what-do-i-do-now/ Thank you, Kevin Link to post Share on other sites More sharing options...
Pablo Posted December 27, 2017 Author ID:1194995 Share Posted December 27, 2017 mwb scan.txt Addition.txt FRST.txt Link to post Share on other sites More sharing options...
kevinf80 Posted December 28, 2017 ID:1195078 Share Posted December 28, 2017 (edited) Hello Pablo, You have smartservice infection, you will need access to another PC and a USB flash drive (memory stick) to remove it via Recovery Environment.... Plug USB Flash Drive into spare PC, navigate to that drive and Right click on it directly, select > Format. Tha quick option is adequate. When the format completes download Farbar Recovery Scan Tool from here:http://www.bleepingcomputer.com/download/farbar-recovery-scan-tool/ save it to a USB flash drive. Ensure to get the correct version for your system, 32 bit or 64 bit.Note: You need to run the version compatible with your system. If you are not sure which version applies to your system download both of them and try to run them. Only one of them will run on your system, that will be the right version. Do NOT plug the Flash drive into the sick PC untill booted to the Recovery Environment If you are using Vista or Windows 7 enter System Recovery Options as follows. Enter System Recovery Options I give two methods, use whichever is convenient for you.To enter System Recovery Options from the Advanced Boot Options: Restart the computer. As soon as the BIOS is loaded begin tapping the F8 key until Advanced Boot Options appears. Use the arrow keys to select the Repair your computer menu item. Select Your Country as the keyboard language settings, and then click Next. Select the operating system you want to repair, and then click Next. Select your user account an click Next. To enter System Recovery Options by using Windows installation disc: Insert the installation disc. Restart your computer. If prompted, press any key to start Windows from the installation disc. If your computer is not configured to start from a CD or DVD, check your BIOS settings. Click Repair your computer. Select Your Country as the keyboard language settings, and then click Next. Select the operating system you want to repair, and then click Next. Select your user account and click Next. On the System Recovery Options menu you may get the following options:Startup Repair System Restore Windows Complete PC Restore Windows Memory Diagnostic Tool Command Prompt Select Command Prompt In the command window type in notepad and press Enter. The notepad opens. Under File menu select Open. Select "Computer" and find your flash drive letter and close the notepad. In the command window type E:\frst64 or E:\frst depending on your version. Press Enter Note: Replace letter E with the drive letter of your flash drive. The tool will start to run. When the tool opens click Yes to disclaimer. Press Scan button. It will make a log (FRST.txt) on the flash drive. Please copy and paste it to your reply. Next, Boot back to Normal Windows, now run Malwarebytes as follows: Open Malwarebytes Anti-Malware. On the Settings tab > Protection Scroll to and make sure the following are selected:Scan for RootkitsScan within Archives Scroll further to Potential Threat Protection make sure the following are set as follows:Potentially Unwanted Programs (PUP`s) set as :- Always detect PUP`s (recommended)Potentially Unwanted Modifications (PUM`s) set as :- Alwaysdetect PUM`s (recommended) Click on the Scan make sure Threat Scan is selected, A Threat Scan will begin. When the scan is complete if anything is found make sure that the first checkbox at the top is checked (that will automatically check all detected items), then click on the Quarantine Selected Tab If asked to restart your computer to complete the removal, please do so When complete click on Export Summary after deletion (bottom-left corner) and select Copy to Clipboard. Wait for the prompt to restart the computer to appear, then click on Yes. After the restart once you are back at your desktop, open MBAM once more to retrieve the log. To get the log from Malwarebytes do the following: Click on the Reports tab > from main interface. Double click on the Scan log which shows the Date and time of the scan just performed. Click Export > From export you have two options:Copy to Clipboard - if seleted right click to your reply and select "Paste" log will be pasted to your replyText file (*.txt) - if selected you will have to name the file and save to a place of choice, recommend "Desktop" then attach to reply Use "Copy to Clipboard, then Right click to your reply > select "Paste" that will copy the log to your reply… Let me see those two logs in your reply.. Thank you, Kevin. Edited December 28, 2017 by kevinf80 typing error Link to post Share on other sites More sharing options...
Pablo Posted December 28, 2017 Author ID:1195141 Share Posted December 28, 2017 My advanced boot options don't have the options you listed. Also I have a windows installation disc but it's for windows 10 and my current pc is windows 7 so how should I proceed? Link to post Share on other sites More sharing options...
kevinf80 Posted December 29, 2017 ID:1195235 Share Posted December 29, 2017 The infection will more than likely turned off or even deleted recovery environment.... Open an elevated command prompt, at the prompt either type or copy/paste bcdedit.exe /set {default} recoveryenabled yes If that works try to follow the instructions I listed previously, if that fails again you can create a system repair disc, boot from that to recovery environment... https://support.microsoft.com/en-us/help/17423/windows-7-create-system-repair-disc Link to post Share on other sites More sharing options...
kevinf80 Posted January 1, 2018 ID:1195771 Share Posted January 1, 2018 Any progress...? Link to post Share on other sites More sharing options...
Pablo Posted January 3, 2018 Author ID:1196111 Share Posted January 3, 2018 Will make an attempt tomorrow morning Link to post Share on other sites More sharing options...
kevinf80 Posted January 3, 2018 ID:1196174 Share Posted January 3, 2018 Thanks for the update, Link to post Share on other sites More sharing options...
Pablo Posted January 3, 2018 Author ID:1196381 Share Posted January 3, 2018 I am unable to use the cmd method, when i enter the line it outputs "the boot configuration data store could not be opened. Access is denied." Also i dont have a disk drive on my pc so I will try to use a usb for recovery. Thanks for your patience and assistance so far, and any further tips are appreciated. Link to post Share on other sites More sharing options...
kevinf80 Posted January 3, 2018 ID:1196384 Share Posted January 3, 2018 (edited) Check your PM`s Edited January 3, 2018 by kevinf80 typing error Link to post Share on other sites More sharing options...
kevinf80 Posted January 6, 2018 ID:1197457 Share Posted January 6, 2018 Any progress..? Link to post Share on other sites More sharing options...
Pablo Posted January 8, 2018 Author ID:1198096 Share Posted January 8, 2018 (edited) New Text Document.txt FRST.txt Edited January 8, 2018 by Pablo Link to post Share on other sites More sharing options...
Pablo Posted January 9, 2018 Author ID:1198151 Share Posted January 9, 2018 I I ran mbytes again and this time did a custom scan for my C drive, came up with 4 threats. Meanwhile I was also running Superantispyware and it showed different threats that werent on mbytes report. I forced shutdown my pc as I was very frusturated at how advanced this infection is. Is there anyway to remove it and save my pc data? Link to post Share on other sites More sharing options...
kevinf80 Posted January 9, 2018 ID:1198193 Share Posted January 9, 2018 Download attached fixlist.txt file (end of reply) and save it to the Desktop, or the folder you saved FRST into. "Do not open that file when running FRST fix" NOTE. It's important that both FRST and fixlist.txt are in the same location or the fix will not work. Open FRST and press the Fix button just once and wait. The tool will make a log on the Desktop (Fixlog.txt) or the folder it was ran from. Please post it to your reply. Next, Download AdwCleaner by Malwarebytes onto your Desktop. Or from this Mirror Right-click on AdwCleaner.exe and select Run as Administrator (for Windows Vista, 7, 8, 8.1 and 10 users) Accept the EULA (I accept), then click on Scan Let the scan complete. Once it's done, make sure that every item listed in the different tabs is checked and click on the Clean button. This will kill all the active processes Once the cleaning process is complete, AdwCleaner will ask to restart your computer, do it After the restart, a log will open when logging in. Please copy/paste the content of that log in your next reply Next, Download Sophos Free Virus Removal Tool and save it to your desktop. If your security alerts to this scan either accept the alert or turn off your security to allow Sophos to run and complete..... Please Do Not use your PC whilst the scan is in progress.... This scan is very thorough so may take several hours... Double click the icon and select Run Click Next Select I accept the terms in this license agreement, then click Next twice Click Install Click Finish to launch the program Once the virus database has been updated click Start Scanning If any threats are found click Details, then View log file... (bottom left hand corner) Copy and paste the results in your reply Close the Notepad document, close the Threat Details screen, then click Start cleanup Click Exit to close the program If no threats were found please confirm that result.... The Virus Removal Tool scans the following areas of your computer: Memory, including system memory on 32-bit (x86) versions of Windows The Windows registry All local hard drives, fixed and removable Mapped network drives are not scanned. Note: If threats are found in the computer memory, the scan stops. This is because further scanning could enable the threat to spread. You will be asked to click Start Cleanup to remove the threats before continuing the scan. Saved logs are found here: C:\ProgramData\Sophos\Sophos Virus Removal Tool\Logs Let me see those logs in your reply, also give an update on any remaining issues or concerns.. Thank you, Kevin... fixlist.txt Link to post Share on other sites More sharing options...
Pablo Posted January 10, 2018 Author ID:1198743 Share Posted January 10, 2018 # AdwCleaner 7.0.6.0 - Logfile created on Wed Jan 10 23:02:28 2018 # Updated on 2017/21/12 by Malwarebytes # Running on Windows 7 Ultimate (X64) # Mode: clean # Support: https://www.malwarebytes.com/support ***** [ Services ] ***** Deleted: vToolbarUpdater18.7.0 ***** [ Folders ] ***** Deleted: C:\ProgramData\IObit\Advanced SystemCare Deleted: C:\ProgramData\Application Data\IObit\Advanced SystemCare Deleted: C:\Windows\System32\config\systemprofile\AppData\Roaming\IObit\Advanced SystemCare Deleted: C:\Program Files (x86)\IObit\Advanced SystemCare Deleted: C:\Program Files (x86)\Common Files\IObit\Advanced SystemCare Deleted: C:\Windows\SysWOW64\config\systemprofile\AppData\Roaming\IObit\Advanced SystemCare Deleted: C:\Users\Ahmed\AppData\LocalLow\IObit\Advanced SystemCare Deleted: C:\Users\Ahmed\AppData\Roaming\IObit\Advanced SystemCare Deleted: C:\Users\All Users\IObit\Advanced SystemCare Deleted: C:\ProgramData\IObit\Advanced SystemCare Deleted: C:\ProgramData\Application Data\IObit\Advanced SystemCare Deleted: C:\Windows\System32\config\systemprofile\AppData\Roaming\IObit\Advanced SystemCare Deleted: C:\Program Files (x86)\IObit\Advanced SystemCare Deleted: C:\Program Files (x86)\Common Files\IObit\Advanced SystemCare Deleted: C:\Windows\SysWOW64\config\systemprofile\AppData\Roaming\IObit\Advanced SystemCare Deleted: C:\Users\Ahmed\AppData\LocalLow\IObit\Advanced SystemCare Deleted: C:\Users\Ahmed\AppData\Roaming\IObit\Advanced SystemCare Deleted: C:\Users\All Users\IObit\Advanced SystemCare Deleted: C:\Users\Ahmed\AppData\Roaming\\browsers Deleted: C:\Windows\System32\\SSL Deleted: C:\Windows\SysWOW64\\SSL Deleted: C:\Program Files (x86)\Common Files\AVG Secure Search Deleted: C:\ProgramData\AVG Security Toolbar Deleted: C:\ProgramData\Application Data\AVG Security Toolbar Deleted: C:\Users\All Users\AVG Security Toolbar Deleted: C:\ProgramData\IObit\ASCDownloader Deleted: C:\ProgramData\Application Data\IObit\ASCDownloader Deleted: C:\Users\All Users\IObit\ASCDownloader Deleted: C:\Program Files (x86)\TotalAV Deleted: C:\Users\Ahmed\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\AppTrailers Deleted: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Solvusoft Deleted: C:\ProgramData\Solvusoft Deleted: C:\ProgramData\Application Data\Solvusoft Deleted: C:\Program Files\Solvusoft Deleted: C:\Program Files (x86)\Solvusoft Deleted: C:\Users\Ahmed\AppData\Roaming\Solvusoft Deleted: C:\Users\All Users\Solvusoft Deleted: C:\Users\Ahmed\AppData\Roaming\\SPI ***** [ Files ] ***** No malicious files deleted. ***** [ DLL ] ***** No malicious DLLs cleaned. ***** [ WMI ] ***** No malicious WMI cleaned. ***** [ Shortcuts ] ***** No malicious shortcuts cleaned. ***** [ Tasks ] ***** Deleted: Driver Booster Scheduler ***** [ Registry ] ***** Deleted: [Key] - HKLM\SOFTWARE\IOBIT\ASC Deleted: [Key] - HKLM\SOFTWARE\IObit\Advanced SystemCare Deleted: [Key] - HKU\S-1-5-21-242380504-2691889551-1728626859-1000\Software\IObit\Advanced SystemCare Deleted: [Key] - HKCU\Software\IObit\Advanced SystemCare Deleted: [Key] - HKLM\SOFTWARE\IObit\RealTimeProtector Deleted: [Key] - HKLM\SOFTWARE\IObit\ASC Deleted: [Key] - HKLM\SOFTWARE\Classes\Interface\{BA935377-E17C-4475-B1BF-DE3110613A99} Deleted: [Key] - HKLM\SOFTWARE\Classes\CLSID\{2803063F-4B8D-4dc6-8874-D1802487FE2D} Deleted: [Key] - HKLM\SOFTWARE\CLASSES\DIRECTORY\SHELLEX\CONTEXTMENUHANDLERS\Advanced SystemCare Deleted: [Key] - HKLM\SOFTWARE\CLASSES\DRIVE\SHELLEX\CONTEXTMENUHANDLERS\Advanced SystemCare Deleted: [Key] - HKLM\SOFTWARE\CLASSES\LNKFILE\SHELLEX\CONTEXTMENUHANDLERS\Advanced SystemCare Deleted: [Key] - HKLM\SOFTWARE\Google\Chrome\NativeMessagingHosts\com.ascplugin.protect Deleted: [Key] - HKLM\SOFTWARE\Classes\*\shellex\ContextMenuHandlers\Advanced SystemCare Deleted: [Key] - HKLM\SOFTWARE\Classes\lnkfile\shellex\ContextMenuHandlers\Advanced SystemCare Deleted: [Key] - HKLM\SOFTWARE\Classes\CLSID\{645FF040-5081-101B-9F08-00AA002F954E}\shellex\ContextMenuHandlers\Advanced SystemCare Deleted: [Key] - HKLM\SOFTWARE\Classes\Drive\shellex\ContextMenuHandlers\Advanced SystemCare Deleted: [Key] - HKLM\SOFTWARE\Classes\Directory\shellex\ContextMenuHandlers\Advanced SystemCare Deleted: [Value] - HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules|{E4937E7F-6692-41D8-BB27-155A9409016B} Deleted: [Value] - HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules|{080B86C1-95F2-48C9-8BA8-C5FE2A10F95C} Deleted: [Value] - HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules|{04785F5E-8DEE-432C-A35A-C73C28318DE3} Deleted: [Value] - HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules|{1FC704A9-9042-4A6C-B804-9DD8E3909E63} Deleted: [Key] - HKLM\SOFTWARE\Classes\CLSID\{BA0C978D-D909-49B6-AFE2-8BDE245DC7E6} Deleted: [Key] - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{BA0C978D-D909-49B6-AFE2-8BDE245DC7E6} Deleted: [Key] - HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{BA0C978D-D909-49B6-AFE2-8BDE245DC7E6} Deleted: [Key] - HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{BA0C978D-D909-49B6-AFE2-8BDE245DC7E6} Deleted: [Key] - HKLM\SOFTWARE\Solvusoft Deleted: [Key] - HKU\S-1-5-21-242380504-2691889551-1728626859-1000\Software\Solvusoft Deleted: [Key] - HKCU\Software\Solvusoft Deleted: [Key] - HKLM\SOFTWARE\CLASSES\APPLICATIONS\SolvusoftTray.exe ***** [ Firefox (and derivatives) ] ***** No malicious Firefox entries deleted. ***** [ Chromium (and derivatives) ] ***** No malicious Chromium entries deleted. ************************* ::Tracing keys deleted ::Winsock settings cleared ::Additional Actions: 0 ************************* C:/AdwCleaner/AdwCleaner[S0].txt - [7173 B] - [2018/1/10 23:1:46] ########## EOF - C:\AdwCleaner\AdwCleaner[C0].txt ########## Fixlog.txt Link to post Share on other sites More sharing options...
Pablo Posted January 11, 2018 Author ID:1198774 Share Posted January 11, 2018 SophosVirusRemovalTool.log SophosVirusRemovalTool_cloud4.log Link to post Share on other sites More sharing options...
kevinf80 Posted January 11, 2018 ID:1198817 Share Posted January 11, 2018 Hello Pablo, Run FRST one more time, ensure all boxes are checkmarked under "Whitelist" but only Addition.txt under "Optional scan" Select scan, when done post the new logs. "FRST.txt" and "Addition.txt" Thank you, Kevin... Link to post Share on other sites More sharing options...
Pablo Posted January 11, 2018 Author ID:1198917 Share Posted January 11, 2018 FRST.txt Addition.txt Link to post Share on other sites More sharing options...
kevinf80 Posted January 11, 2018 ID:1198946 Share Posted January 11, 2018 Thanks for those logs, continue: Download attached fixlist.txt file (end of reply) and save it to the Desktop, or the folder you saved FRST into. "Do not open that file when running FRST fix" NOTE. It's important that both FRST and fixlist.txt are in the same location or the fix will not work. Open FRST and press the Fix button just once and wait. The tool will make a log on the Desktop (Fixlog.txt) or the folder it was ran from. Please post it to your reply. Let me see that log, also tell me if there are any remaining issues or concerns.... Thanks, Kevin... fixlist.txt Link to post Share on other sites More sharing options...
Pablo Posted January 11, 2018 Author ID:1198947 Share Posted January 11, 2018 Everything is running much faster and pc boots up faster aswell so i am assuming everything is almost back to normal. I am slightly concerned about this unremovable key that is showing up in the fixlogs (not sure if it means anything) . I have attached it below. Thanks for everything so far! Fixlog.txt Link to post Share on other sites More sharing options...
kevinf80 Posted January 11, 2018 ID:1198953 Share Posted January 11, 2018 Yes that service is a remnant of smartservice infection, the only way to remove that will be via Recovery Environment... Save the attached file fixlist.txt to your flash drive, same place as FRST. Run System Recovery Options as you did previously Run FRST and press the Fix button just once and wait. The tool will make a log on the flashdrive (Fixlog.txt) please post it to your reply. Thanks, Kevin... fixlist.txt Link to post Share on other sites More sharing options...
Pablo Posted January 11, 2018 Author ID:1198965 Share Posted January 11, 2018 Fixlog.txt Link to post Share on other sites More sharing options...
kevinf80 Posted January 11, 2018 ID:1198967 Share Posted January 11, 2018 Very strange, service is not found...? Save the attached file fixlist.txt to your flash drive, same place as FRST. Run System Recovery Options as you did previously Run FRST and press the Fix button just once and wait. The tool will make a log on the flashdrive (Fixlog.txt) please post it to your reply. Thanks, Kevin... fixlist.txt Link to post Share on other sites More sharing options...
Pablo Posted January 12, 2018 Author ID:1199035 Share Posted January 12, 2018 persistent indeed Fixlog.txt Link to post Share on other sites More sharing options...
Recommended Posts