Torpig Infection

Celo · January 1, 2018

My Hotmail was hijacked. After contacting Microsoft they told me my computer was infected with torpig. I run Norton but it did not detect anything. This forum was the only place I found that has recorded solution from other users that were infected with the same virus. I appreciate if someone could help me removing it from my computer.

Thank you very much!

Marcelo

kevinf80 · January 2, 2018

Hello Marcelo and welcome to Malwarebytes,

Follow the instructions at this link and post the requested logs: https://forums.malwarebytes.com/topic/9573-im-infected-what-do-i-do-now/

Thank you,

Kevin

Celo · January 3, 2018

Malwarebytes log. It did not ask for it but I thought it may be a good idea to show. I did quarantine the items and restarted the computer.

Malwarebytes
www.malwarebytes.com

-Log Details-
Scan Date: 1/2/18
Scan Time: 6:51 PM
Log File: ffbbc72c-f030-11e7-b472-0025647b4fad.json
Administrator: Yes

-Software Information-
Version: 3.3.1.2183
Components Version: 1.0.262
Update Package Version: 1.0.3610
License: Trial

-System Information-
OS: Windows 7 Service Pack 1
CPU: x64
File System: NTFS
User: Marcelo-PC\Marcelo

-Scan Summary-
Scan Type: Threat Scan
Result: Completed
Objects Scanned: 264273
Threats Detected: 101
Threats Quarantined: 0
(No malicious items detected)
Time Elapsed: 8 min, 1 sec

-Scan Options-
Memory: Enabled
Startup: Enabled
Filesystem: Enabled
Archives: Enabled
Rootkits: Disabled
Heuristics: Enabled
PUP: Detect
PUM: Detect

-Scan Details-
Process: 0
(No malicious items detected)

Module: 0
(No malicious items detected)

Registry Key: 3
PUP.Optional.DriverTuner, HKU\S-1-5-21-379400296-1464391431-3024311811-1000\SOFTWARE\DriverTuner, No Action By User, [2066], [469705],1.0.3610
PUP.Optional.DriverTuner, HKU\S-1-5-21-379400296-1464391431-3024311811-1000\SOFTWARE\DriverTuner_Init, No Action By User, [2066], [469705],1.0.3610
PUP.Optional.DriverTuner, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\{520C1D80-935C-42B9-9340-E883849D804F}_is1, No Action By User, [2066], [469700],1.0.3610

Registry Value: 0
(No malicious items detected)

Registry Data: 0
(No malicious items detected)

Data Stream: 0
(No malicious items detected)

Folder: 21
PUP.Optional.WinThruster, C:\Users\Marcelo\AppData\Roaming\Solvusoft\Solvusoft Suite\Logs, No Action By User, [8056], [461214],1.0.3610
PUP.Optional.WinThruster, C:\USERS\MARCELO\APPDATA\ROAMING\SOLVUSOFT\SOLVUSOFT SUITE, No Action By User, [8056], [461214],1.0.3610
PUP.Optional.WinThruster, C:\ProgramData\Solvusoft\Solvusoft Suite\Logs, No Action By User, [8056], [461214],1.0.3610
PUP.Optional.WinThruster, C:\PROGRAMDATA\SOLVUSOFT\SOLVUSOFT SUITE, No Action By User, [8056], [461214],1.0.3610
PUP.Optional.WinThruster, C:\ProgramData\Solvusoft\Tray\Logs, No Action By User, [8056], [461215],1.0.3610
PUP.Optional.WinThruster, C:\PROGRAMDATA\SOLVUSOFT\TRAY, No Action By User, [8056], [461215],1.0.3610
PUP.Optional.WinThruster, C:\Users\Marcelo\AppData\Roaming\Solvusoft\Tray\AutoInstall, No Action By User, [8056], [461215],1.0.3610
PUP.Optional.WinThruster, C:\Users\Marcelo\AppData\Roaming\Solvusoft\Tray\Logs, No Action By User, [8056], [461215],1.0.3610
PUP.Optional.WinThruster, C:\USERS\MARCELO\APPDATA\ROAMING\SOLVUSOFT\TRAY, No Action By User, [8056], [461215],1.0.3610
PUP.Optional.WinThruster, C:\ProgramData\Solvusoft\WinThruster\InstallCache\{DC9009F8-98BE-4E75-B77D-B839CA8C8EC3}, No Action By User, [8056], [461216],1.0.3610
PUP.Optional.WinThruster, C:\ProgramData\Solvusoft\WinThruster\InstallCache, No Action By User, [8056], [461216],1.0.3610
PUP.Optional.WinThruster, C:\PROGRAMDATA\SOLVUSOFT\WinThruster, No Action By User, [8056], [461216],1.0.3610
PUP.Optional.WinThruster, C:\ProgramData\Solvusoft\WinThruster64\Backup, No Action By User, [8056], [461216],1.0.3610
PUP.Optional.WinThruster, C:\ProgramData\Solvusoft\WinThruster64\LOGS, No Action By User, [8056], [461216],1.0.3610
PUP.Optional.WinThruster, C:\PROGRAMDATA\SOLVUSOFT\WinThruster64, No Action By User, [8056], [461216],1.0.3610
PUP.Optional.DriverTuner, C:\Program Files (x86)\DriverTuner\download, No Action By User, [2066], [469700],1.0.3610
PUP.Optional.DriverTuner, C:\Program Files (x86)\DriverTuner\backup, No Action By User, [2066], [469700],1.0.3610
PUP.Optional.DriverTuner, C:\Program Files (x86)\DriverTuner\update, No Action By User, [2066], [469700],1.0.3610
PUP.Optional.DriverTuner, C:\Program Files (x86)\DriverTuner\image, No Action By User, [2066], [469700],1.0.3610
PUP.Optional.DriverTuner, C:\PROGRAM FILES (X86)\DRIVERTUNER, No Action By User, [2066], [469700],1.0.3610
PUP.Optional.DriverTuner, C:\PROGRAMDATA\MICROSOFT\WINDOWS\START MENU\PROGRAMS\DRIVERTUNER, No Action By User, [2066], [469701],1.0.3610

File: 77
PUP.Optional.WinThruster, C:\USERS\MARCELO\APPDATA\ROAMING\SOLVUSOFT\SOLVUSOFT SUITE\LOGS\Client.log.txt, No Action By User, [8056], [461214],1.0.3610
PUP.Optional.DriverTuner.TskLnk, C:\PROGRAM FILES (X86)\DRIVERTUNER\DRIVERTUNER.EXE, No Action By User, [2206], [469703],1.0.3610
PUP.Optional.WinThruster, C:\PROGRAMDATA\SOLVUSOFT\SOLVUSOFT SUITE\LOGS\MachineId.log.txt, No Action By User, [8056], [461214],1.0.3610
PUP.Optional.WinThruster, C:\ProgramData\Solvusoft\Tray\Logs\CommonTrayInstaller.log.txt, No Action By User, [8056], [461215],1.0.3610
PUP.Optional.WinThruster, C:\Users\Marcelo\AppData\Roaming\Solvusoft\Tray\AutoInstall\FDPRO_DL_01-825x338-72dpi.jpg, No Action By User, [8056], [461215],1.0.3610
PUP.Optional.WinThruster, C:\Users\Marcelo\AppData\Roaming\Solvusoft\Tray\AutoInstall\RCPRO_DL_03-825x338-72dpi.jpg, No Action By User, [8056], [461215],1.0.3610
PUP.Optional.WinThruster, C:\Users\Marcelo\AppData\Roaming\Solvusoft\Tray\AutoInstall\DLPRO.xml, No Action By User, [8056], [461215],1.0.3610
PUP.Optional.WinThruster, C:\Users\Marcelo\AppData\Roaming\Solvusoft\Tray\AutoInstall\DLPRO_DL_01-825x338-72dpi.jpg, No Action By User, [8056], [461215],1.0.3610
PUP.Optional.WinThruster, C:\Users\Marcelo\AppData\Roaming\Solvusoft\Tray\AutoInstall\DLPRO_DL_02-825x338-72dpi.jpg, No Action By User, [8056], [461215],1.0.3610
PUP.Optional.WinThruster, C:\Users\Marcelo\AppData\Roaming\Solvusoft\Tray\AutoInstall\DLPRO_DL_03-825x338-72dpi.jpg, No Action By User, [8056], [461215],1.0.3610
PUP.Optional.WinThruster, C:\Users\Marcelo\AppData\Roaming\Solvusoft\Tray\AutoInstall\DM.exe, No Action By User, [8056], [461215],1.0.3610
PUP.Optional.WinThruster, C:\Users\Marcelo\AppData\Roaming\Solvusoft\Tray\AutoInstall\DVPRO.xml, No Action By User, [8056], [461215],1.0.3610
PUP.Optional.WinThruster, C:\Users\Marcelo\AppData\Roaming\Solvusoft\Tray\AutoInstall\DVPRO_DL_01-825x338-72dpi.jpg, No Action By User, [8056], [461215],1.0.3610
PUP.Optional.WinThruster, C:\Users\Marcelo\AppData\Roaming\Solvusoft\Tray\AutoInstall\DVPRO_DL_02-825x338-72dpi.jpg, No Action By User, [8056], [461215],1.0.3610
PUP.Optional.WinThruster, C:\Users\Marcelo\AppData\Roaming\Solvusoft\Tray\AutoInstall\DVPRO_DL_03-825x338-72dpi.jpg, No Action By User, [8056], [461215],1.0.3610
PUP.Optional.WinThruster, C:\Users\Marcelo\AppData\Roaming\Solvusoft\Tray\AutoInstall\FDPRO.xml, No Action By User, [8056], [461215],1.0.3610
PUP.Optional.WinThruster, C:\Users\Marcelo\AppData\Roaming\Solvusoft\Tray\AutoInstall\FDPRO_DL_02-825x338-72dpi.jpg, No Action By User, [8056], [461215],1.0.3610
PUP.Optional.WinThruster, C:\Users\Marcelo\AppData\Roaming\Solvusoft\Tray\AutoInstall\FDPRO_DL_03-825x338-72dpi.jpg, No Action By User, [8056], [461215],1.0.3610
PUP.Optional.WinThruster, C:\Users\Marcelo\AppData\Roaming\Solvusoft\Tray\AutoInstall\lang.xml, No Action By User, [8056], [461215],1.0.3610
PUP.Optional.WinThruster, C:\Users\Marcelo\AppData\Roaming\Solvusoft\Tray\AutoInstall\PWPRO.xml, No Action By User, [8056], [461215],1.0.3610
PUP.Optional.WinThruster, C:\Users\Marcelo\AppData\Roaming\Solvusoft\Tray\AutoInstall\PWPRO_DL_01-825x338-72dpi.jpg, No Action By User, [8056], [461215],1.0.3610
PUP.Optional.WinThruster, C:\Users\Marcelo\AppData\Roaming\Solvusoft\Tray\AutoInstall\PWPRO_DL_02-825x338-72dpi.jpg, No Action By User, [8056], [461215],1.0.3610
PUP.Optional.WinThruster, C:\Users\Marcelo\AppData\Roaming\Solvusoft\Tray\AutoInstall\PWPRO_DL_03-825x338-72dpi.jpg, No Action By User, [8056], [461215],1.0.3610
PUP.Optional.WinThruster, C:\Users\Marcelo\AppData\Roaming\Solvusoft\Tray\AutoInstall\RCPRO.xml, No Action By User, [8056], [461215],1.0.3610
PUP.Optional.WinThruster, C:\Users\Marcelo\AppData\Roaming\Solvusoft\Tray\AutoInstall\RCPRO_DL_01-825x338-72dpi.jpg, No Action By User, [8056], [461215],1.0.3610
PUP.Optional.WinThruster, C:\Users\Marcelo\AppData\Roaming\Solvusoft\Tray\AutoInstall\RCPRO_DL_02-825x338-72dpi.jpg, No Action By User, [8056], [461215],1.0.3610
PUP.Optional.WinThruster, C:\Users\Marcelo\AppData\Roaming\Solvusoft\Tray\AutoInstall\SFPRO.xml, No Action By User, [8056], [461215],1.0.3610
PUP.Optional.WinThruster, C:\Users\Marcelo\AppData\Roaming\Solvusoft\Tray\AutoInstall\SFPRO_DL_01-825x338-72dpi.jpg, No Action By User, [8056], [461215],1.0.3610
PUP.Optional.WinThruster, C:\Users\Marcelo\AppData\Roaming\Solvusoft\Tray\AutoInstall\SFPRO_DL_02-825x338-72dpi.jpg, No Action By User, [8056], [461215],1.0.3610
PUP.Optional.WinThruster, C:\Users\Marcelo\AppData\Roaming\Solvusoft\Tray\AutoInstall\SFPRO_DL_03-825x338-72dpi.jpg, No Action By User, [8056], [461215],1.0.3610
PUP.Optional.WinThruster, C:\Users\Marcelo\AppData\Roaming\Solvusoft\Tray\AutoInstall\SWPRO.xml, No Action By User, [8056], [461215],1.0.3610
PUP.Optional.WinThruster, C:\Users\Marcelo\AppData\Roaming\Solvusoft\Tray\AutoInstall\SWPRO_DL_01-825x338-72dpi.jpg, No Action By User, [8056], [461215],1.0.3610
PUP.Optional.WinThruster, C:\Users\Marcelo\AppData\Roaming\Solvusoft\Tray\AutoInstall\SWPRO_DL_02-825x338-72dpi.jpg, No Action By User, [8056], [461215],1.0.3610
PUP.Optional.WinThruster, C:\Users\Marcelo\AppData\Roaming\Solvusoft\Tray\AutoInstall\SWPRO_DL_03-825x338-72dpi.jpg, No Action By User, [8056], [461215],1.0.3610
PUP.Optional.WinThruster, C:\Users\Marcelo\AppData\Roaming\Solvusoft\Tray\AutoInstall\VFPRO.xml, No Action By User, [8056], [461215],1.0.3610
PUP.Optional.WinThruster, C:\Users\Marcelo\AppData\Roaming\Solvusoft\Tray\AutoInstall\VFPRO_DL_01-825x338-72dpi.jpg, No Action By User, [8056], [461215],1.0.3610
PUP.Optional.WinThruster, C:\Users\Marcelo\AppData\Roaming\Solvusoft\Tray\AutoInstall\VFPRO_DL_02-825x338-72dpi.jpg, No Action By User, [8056], [461215],1.0.3610
PUP.Optional.WinThruster, C:\Users\Marcelo\AppData\Roaming\Solvusoft\Tray\AutoInstall\VFPRO_DL_03-825x338-72dpi.jpg, No Action By User, [8056], [461215],1.0.3610
PUP.Optional.WinThruster, C:\Users\Marcelo\AppData\Roaming\Solvusoft\Tray\Logs\Tray.log.txt, No Action By User, [8056], [461215],1.0.3610
PUP.Optional.WinThruster, C:\ProgramData\Solvusoft\WinThruster\InstallCache\{DC9009F8-98BE-4E75-B77D-B839CA8C8EC3}\1033.MST, No Action By User, [8056], [461216],1.0.3610
PUP.Optional.WinThruster, C:\ProgramData\Solvusoft\WinThruster\InstallCache\{DC9009F8-98BE-4E75-B77D-B839CA8C8EC3}\WinThruster.msi, No Action By User, [8056], [461216],1.0.3610
PUP.Optional.WinThruster, C:\ProgramData\Solvusoft\WinThruster64\Backup\Backup_December_17_17_13_44_04.reg, No Action By User, [8056], [461216],1.0.3610
PUP.Optional.WinThruster, C:\ProgramData\Solvusoft\WinThruster64\LOGS\LOGS_12_17_2017_13_27_53_PM.log, No Action By User, [8056], [461216],1.0.3610
PUP.Optional.WinThruster, C:\ProgramData\Solvusoft\WinThruster64\TipofDay_EN-US.xml, No Action By User, [8056], [461216],1.0.3610
PUP.Optional.WinThruster, C:\ProgramData\Solvusoft\WinThruster64\wxfdata.wxf, No Action By User, [8056], [461216],1.0.3610
PUP.Optional.DriverTuner, C:\Program Files (x86)\DriverTuner\image\uninstall_btn_de.bmp, No Action By User, [2066], [469700],1.0.3610
PUP.Optional.DriverTuner, C:\Program Files (x86)\DriverTuner\image\uninstall_btn_en.bmp, No Action By User, [2066], [469700],1.0.3610
PUP.Optional.DriverTuner, C:\Program Files (x86)\DriverTuner\image\uninstall_btn_es.bmp, No Action By User, [2066], [469700],1.0.3610
PUP.Optional.DriverTuner, C:\Program Files (x86)\DriverTuner\image\uninstall_btn_fr.bmp, No Action By User, [2066], [469700],1.0.3610
PUP.Optional.DriverTuner, C:\Program Files (x86)\DriverTuner\image\uninstall_btn_it.bmp, No Action By User, [2066], [469700],1.0.3610
PUP.Optional.DriverTuner, C:\Program Files (x86)\DriverTuner\image\uninstall_btn_jp.bmp, No Action By User, [2066], [469700],1.0.3610
PUP.Optional.DriverTuner, C:\Program Files (x86)\DriverTuner\image\uninstall_btn_pt.bmp, No Action By User, [2066], [469700],1.0.3610
PUP.Optional.DriverTuner, C:\Program Files (x86)\DriverTuner\image\uninstall_main_de.bmp, No Action By User, [2066], [469700],1.0.3610
PUP.Optional.DriverTuner, C:\Program Files (x86)\DriverTuner\image\uninstall_main_en.bmp, No Action By User, [2066], [469700],1.0.3610
PUP.Optional.DriverTuner, C:\Program Files (x86)\DriverTuner\image\uninstall_main_es.bmp, No Action By User, [2066], [469700],1.0.3610
PUP.Optional.DriverTuner, C:\Program Files (x86)\DriverTuner\image\uninstall_main_fr.bmp, No Action By User, [2066], [469700],1.0.3610
PUP.Optional.DriverTuner, C:\Program Files (x86)\DriverTuner\image\uninstall_main_it.bmp, No Action By User, [2066], [469700],1.0.3610
PUP.Optional.DriverTuner, C:\Program Files (x86)\DriverTuner\image\uninstall_main_jp.bmp, No Action By User, [2066], [469700],1.0.3610
PUP.Optional.DriverTuner, C:\Program Files (x86)\DriverTuner\image\uninstall_main_pt.bmp, No Action By User, [2066], [469700],1.0.3610
PUP.Optional.DriverTuner, C:\Program Files (x86)\DriverTuner\update\update.EXE, No Action By User, [2066], [469700],1.0.3610
PUP.Optional.DriverTuner, C:\Program Files (x86)\DriverTuner\update\update.URS, No Action By User, [2066], [469700],1.0.3610
PUP.Optional.DriverTuner, C:\Program Files (x86)\DriverTuner\update\UpdateLang.ini, No Action By User, [2066], [469700],1.0.3610
PUP.Optional.DriverTuner, C:\Program Files (x86)\DriverTuner\DPInst32.exe, No Action By User, [2066], [469700],1.0.3610
PUP.Optional.DriverTuner, C:\Program Files (x86)\DriverTuner\DPInst64.exe, No Action By User, [2066], [469700],1.0.3610
PUP.Optional.DriverTuner, C:\Program Files (x86)\DriverTuner\DriverTuner.url, No Action By User, [2066], [469700],1.0.3610
PUP.Optional.DriverTuner, C:\Program Files (x86)\DriverTuner\language.ini, No Action By User, [2066], [469700],1.0.3610
PUP.Optional.DriverTuner, C:\Program Files (x86)\DriverTuner\libcurlds.dll, No Action By User, [2066], [469700],1.0.3610
PUP.Optional.DriverTuner, C:\Program Files (x86)\DriverTuner\license.txt, No Action By User, [2066], [469700],1.0.3610
PUP.Optional.DriverTuner, C:\Program Files (x86)\DriverTuner\msvcp100.dll, No Action By User, [2066], [469700],1.0.3610
PUP.Optional.DriverTuner, C:\Program Files (x86)\DriverTuner\msvcr100.dll, No Action By User, [2066], [469700],1.0.3610
PUP.Optional.DriverTuner, C:\Program Files (x86)\DriverTuner\unins000.dat, No Action By User, [2066], [469700],1.0.3610
PUP.Optional.DriverTuner, C:\Program Files (x86)\DriverTuner\unins000.exe, No Action By User, [2066], [469700],1.0.3610
PUP.Optional.DriverTuner, C:\Program Files (x86)\DriverTuner\zlibwapi.dll, No Action By User, [2066], [469700],1.0.3610
PUP.Optional.DriverTuner, C:\ProgramData\Microsoft\Windows\Start Menu\Programs\DriverTuner\DriverTuner on the Web.url, No Action By User, [2066], [469701],1.0.3610
PUP.Optional.DriverTuner, C:\ProgramData\Microsoft\Windows\Start Menu\Programs\DriverTuner\DriverTuner.lnk, No Action By User, [2066], [469701],1.0.3610
PUP.Optional.DriverTuner, C:\ProgramData\Microsoft\Windows\Start Menu\Programs\DriverTuner\Uninstall DriverTuner.lnk, No Action By User, [2066], [469701],1.0.3610
PUP.Optional.DriverTuner, C:\ProgramData\Microsoft\Windows\Start Menu\Programs\DriverTuner\update.lnk, No Action By User, [2066], [469701],1.0.3610

Physical Sector: 0
(No malicious items detected)

(end)

Celo · January 3, 2018

Will do the Farbar Recovery Scan Tool next. Thanks

kevinf80 · January 3, 2018

Thanks for the update, post FRST logs when ready...

Celo · January 3, 2018

Should I delete the quarantine items from the Malwarebytes scan? Will do FRST today. Thanks

Celo · January 3, 2018

See FRST logs attached. Thanks

Addition.txt

FRST.txt

kevinf80 · January 3, 2018

Yes you can delete the quarantined entries in Malwarebytes...

Next,

Open Malwarebytes Anti-Malware.

On the Settings tab > Protection Scroll to and make sure the following are selected: Scroll to and make sure the following are selected:
Scan for Rootkits
Scan within Archives
Scroll further to Potential Threat Protection make sure the following are set as follows:

Potentially Unwanted Programs (PUP`s) set as :- Always detect PUP`s (recommended)
Potentially Unwanted Modifications (PUM`s) set as :- Alwaysdetect PUM`s (recommended)
Click on the Scan make sure Threat Scan is selected,
A Threat Scan will begin.
When the scan is complete if anything is found make sure that the first checkbox at the top is checked (that will automatically check all detected items), then click on the Quarantine Selected Tab
If asked to restart your computer to complete the removal, please do so
When complete click on Export Summary after deletion (bottom-left corner) and select Copy to Clipboard.
Wait for the prompt to restart the computer to appear, then click on Yes.
After the restart once you are back at your desktop, open MBAM once more to retrieve the log.

To get the log from Malwarebytes do the following:

Click on the Reports tab > from main interface.
Double click on the Scan log which shows the Date and time of the scan just performed.
Click Export > From export you have two options: > From export you have two options:
Copy to Clipboard - if seleted right click to your reply and select "Paste" log will be pasted to your reply
Text file (*.txt) - if selected you will have to name the file and save to a place of choice, recommend "Desktop" then attach to reply
Use "Copy to Clipboard, then Right click to your reply > select "Paste" that will copy the log to your reply…

Next,

Download AdwCleaner by Malwarebytes onto your Desktop.

Or from this Mirror

Right-click on AdwCleaner.exe and select Run as Administrator (for Windows Vista, 7, 8, 8.1 and 10 users)
Accept the EULA (I accept), then click on Scan
Let the scan complete. Once it's done, make sure that every item listed in the different tabs is checked and click on the Clean button. This will kill all the active processes
Once the cleaning process is complete, AdwCleaner will ask to restart your computer, do it
After the restart, a log will open when logging in. Please copy/paste the content of that log in your next reply

Next,

Download Sophos Free Virus Removal Tool and save it to your desktop.

If your security alerts to this scan either accept the alert or turn off your security to allow Sophos to run and complete.....

Please Do Not use your PC whilst the scan is in progress.... This scan is very thorough so may take several hours...

Double click the icon and select Run
Click Next
Select I accept the terms in this license agreement, then click Next twice
Click Install
Click Finish to launch the program
Once the virus database has been updated click Start Scanning
If any threats are found click Details, then View log file... (bottom left hand corner)
Copy and paste the results in your reply
Close the Notepad document, close the Threat Details screen, then click Start cleanup
Click Exit to close the program
If no threats were found please confirm that result....

The Virus Removal Tool scans the following areas of your computer:

Memory, including system memory on 32-bit (x86) versions of Windows
The Windows registry
All local hard drives, fixed and removable
Mapped network drives are not scanned.

Note: If threats are found in the computer memory, the scan stops. This is because further scanning could enable the threat to spread. You will be asked to click Start Cleanup to remove the threats before continuing the scan.

Saved logs are found here: C:\ProgramData\Sophos\Sophos Virus Removal Tool\Logs

Let me see those logs in your next reply... Also do you know and trust software belong to the following:

Caixa Economica Federal
GAS Tecnologia

Thank you,

Kevin,,

Celo · January 3, 2018

I deleted the quarantined entries in Malwarebytes.

I know and trust Caixa Economica Federal and GAS Tecnologia, but they could definitely be removed. No longer use them. I did not see them as an option to be removed in control panel \ programs.

Now I will do the above as instructed.

kevinf80 · January 3, 2018

Thanks for the update, I will give you a FRST fix to remove the entries related to the software I asked about after you post latest logs...

Celo · January 3, 2018

Nothing found with Malwarebytes scan with Rootkits Archives PUPs & PUMs. See log attached. Now adwcleaner ....

Malwarebytes Log with Rootkits Archives PUPs & PUMs.txt

kevinf80 · January 3, 2018

Thanks for that log, i`m going offline very shortly so will not be about when you post logs from AdwCleaner and Sophos... The FRST fix follows, run that after Sophos has completed..

Download attached fixlist.txt file (end of reply) and save it to the Desktop, or the folder you saved FRST into. "Do not open that file when running FRST fix"
NOTE. It's important that both FRST and fixlist.txt are in the same location or the fix will not work.

Open FRST and press the Fix button just once and wait.
The tool will make a log on the Desktop (Fixlog.txt) or the folder it was ran from. Please post it to your reply.

Thanks,

Kevin

fixlist.txt

Celo · January 4, 2018

AdwCleaner logs attached. Both C and S.

Sophos did not find anything!

Now fixlist.txt ....

AdwCleaner[C0].txt

AdwCleaner[S0].txt

Celo · January 4, 2018

I will not be around tomorrow, Thursday, responses from me will be delayed to later in the day when I get back from work or Friday morning.

Meanwhile, a couple of questions related to the fixlist script:

Why do I see many references to Sys32 if my Sys is 64?
What do the firewall rules at the end do? both of them but more specifically allowing port 5357.

Thanks

kevinf80 · January 4, 2018

Thanks for the update, will catch up later for frst fix...

Your system is 64 bit, now for the confusion. All 64 bit entries run from System32 folder, your system can still run X86 (32 bit) software, all of those entries run from Syswow64 folder.

Firewall rules are created by software you may install, your security or yourself. Malware/Infection is also capable of creating FW rules. The entries I listed for removal were not needed, the latter (port 5357) was just an open port with no obvious link or reason....

Celo · January 5, 2018

I run FRST fix and have the log file. Lost connection to the Internet on the laptop. Did the fix mess with DNS? Thanks

Edited January 5, 2018 by Celo

Celo · January 5, 2018

DNS was flushed right? Per end of script.

Edited January 5, 2018 by Celo

kevinf80 · January 5, 2018

Yes but that flush command does not remove any settings, can I see the log from that fix... Is your connection still down...?

Celo · January 5, 2018

Cannot send it. Still cannot connect to the wifi. Will need to figure out what went wrong.

kevinf80 · January 5, 2018

Select start, in the search box type services.msc hit enter, in the new window check these entries are running and set to automatic:

DHCP Client
DNS Client

Go to Start > All Programs > Accessories > Right click on "Command Prompt" select "Run As Administrator"

Type or copy/paste the following commands hit the enter key after each one,

netsh winsock reset catalog
netsh int ipv4 reset reset.log
netsh int ipv6 reset reset.log
ipconfig /flushdns
ipconfig /release
ipconfig /renew
ipconfig /registerdns

Then reboot.

Is connection now ok?

Celo · January 5, 2018

Still no connection.

ip release and renew failed with the following message: the operation failed as no adapter is in the state permissible for this operation.

kevinf80 · January 5, 2018

Can you run this and post the produced log:

Download Farbar Service Scanner from here: http://www.bleepingcomputer.com/download/farbar-service-scanner/dl/62/ and run it on the computer with the issue.

Make sure the following options are checked:

Internet Services
Windows Firewall
System Restore
Security Center/Action Center
Windows Update
Windows Defender

Press "Scan".
It will create a log (FSS.txt) in the same directory the tool is run.
Please copy and paste the log to your reply.

Celo · January 5, 2018

Can’t do that without connection on the computer. Need to figure out connection first.

kevinf80 · January 5, 2018

Apologies I thought you were using a spare PC...

Can you open Device Manager, scroll to and expand "Network Adapters" what entries are listed, do any have question or exclamation mark against them...

Celo · January 5, 2018

They are all good saying device is working properly

Torpig Infection

Recommended Posts

Link to post

Share on other sites

Top Posters In This Topic

Popular Days

Top Posters In This Topic

Popular Days

Posted Images

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Recently Browsing 0 members

Important Information