System Tool Removal

[nealhines]

I followed instructions posted at:

http://www.myantispyware.com/2010/10/24/ho...l-instructions/

for removing System Tool Virus (1/7/11 is when it revealed itself on my laptop). I bought the full, PRO version of MBAM. I can run in safe mode with networking, but running MBAM quick and full scans and following the instructions (including reset hosts using OTR) isn't removing System Tool. When I reboot to regular mode I still have the virus disabling all my .exe's.

Hmmmm, I also found a Windows program for removal of malicious software windows-kb890830-v3.14.exe version 3.14.4403.0 which didn't kill it. I also tried the program rkill.exe which I thought was suppose to kill viruses.

Any suggestions? Is it fine to just run my Windows XP in safe mode with networking indefinitely? I also picked up the Crawler bug along the way (browser tool virus), but I think I removed it.

Many thanks,

Neal Hines

[Kenny94]

Hi nealhines and Welcome to Malwarebytes!

Sorry for all the confusion. Okay, in your in Safe Mode with networking. Right. Lets try the below in normal mode. DDS should run in normal mode with this infection.

We need to look at some information about what is going on in your computer:

Please perform the following scan:

• Download DDS by sUBs from one of the following links. Save it to your desktop.
  • DDS.scr
    
  • DDS.pif
    

  [*]Double click on the DDS icon, allow it to run.

  [*]A small box will open, with an explanation about the tool.

  [*]When done, DDS will open two (2) logs

  1. DDS.txt

  2. Attach.txt

  [*] Save both reports to your desktop.

  [*] The instructions here ask you to attach the Attach.txt.

  

  [*]Instead of attaching, please copy/past both logs into your Thread

  [*]Close the program window, and delete the program from your desktop.

Please note: You may have to disable any script protection running if the scan fails to run.

After downloading the tool, disconnect from the internet and disable all antivirus protection.

Run the scan, enable your A/V and reconnect to the internet.

Information on A/V control HEREThen post your DDS (DDS.txt and Attach.txt

[nealhines]

DDS.pif scans as a Trojan on my work computer.

Depending upon your reply, I will have to report this to malware.

-Neal

Hi nealhines and Welcome to Malwarebytes!

Sorry for all the confusion. Okay, in your in Safe Mode with networking. Right. Lets try the below in normal mode. DDS should run in normal mode with this infection.

We need to look at some information about what is going on in your computer:

Please perform the following scan:

• Download DDS by sUBs from one of the following links. Save it to your desktop.
  • DDS.scr
    
  • DDS.pif
    

  [*]Double click on the DDS icon, allow it to run.

  [*]A small box will open, with an explanation about the tool.

  [*]When done, DDS will open two (2) logs

  1. DDS.txt

  2. Attach.txt

  [*] Save both reports to your desktop.

  [*] The instructions here ask you to attach the Attach.txt.

  

  [*]Instead of attaching, please copy/past both logs into your Thread

  [*]Close the program window, and delete the program from your desktop.

Please note: You may have to disable any script protection running if the scan fails to run.

After downloading the tool, disconnect from the internet and disable all antivirus protection.

Run the scan, enable your A/V and reconnect to the internet.

Information on A/V control HEREThen post your DDS (DDS.txt and Attach.txt

[Kenny94]

DDS.pif scans as a Trojan on my work computer

It's not malware Neal. You need to disable all antivirus protection and post the logs. When you are done be sure to enable your antivirus.

[nealhines]

OK, sorry for the bit of hypersensitivity. It's been 4-5 days of trying to rid the machine of this .exe Rogue and it's making me a bit edgy.

I actually found the .exe system tool rogue virus under c:\Documents and settings\all users\application data\some numeric folder. I deleted it and can run in regular mode now and am doing some other scans (Stopzilla catches System Tool), but I'll follow your advice after I get the system back up with malware and antispyware and McAfee all restored. I'll be overly cautious now, and hopfully the scanning programs won't conflict with each other. If I understand things right, you need

1) anti malware

2) anti spyware

3) a good pro-active protection program like McAfee or similar.

Ugh, my next computer will definitely be a Mac.

Will report back tomorrow.

Thanks,

Neal

DDS.pif scans as a Trojan on my work computer.

Depending upon your reply, I will have to report this to malware.

-Neal

[Kenny94]

Try not to run anything other than DDS. It's like a X Ray that will show me what's going on and why this has happen. Then when I see the reports... We'll remove this infection with a tool after I look at the DDS.txt and Attach.txt. Kindly follow my instructions and please do no fixing on your own or running of scanners.....

[nealhines]

OK, so it has been challenging to get DDS.pif. DDS.scr is no problem. On my infected laptop, DDS.pif opens using Firefox browser as jibberish characters, and I could not "save target as", so I tried Internet Explorer: the URLs forosypware froze and sourceforge.net would not allow me to download it. It seems my laptop is missing some script that allows .part files to be read. Other searches about where to download DDS.pif and clicking on these links would not get the program onto my laptop. At work, downloading DDS.pif is identified as a serious threat (Trojan), but I can "save target as" (as .htm) onto my USB memory key. DDS.scr and DDS.pif do look like they'll examine the digital guts of this sorry laptop, so I will perservere, and make a contribution to the fund you identified down the road.

-Neal

DDS.pif scans as a Trojan on my work computer.

Depending upon your reply, I will have to report this to malware.

-Neal

[Kenny94]

Please read "ALL" of the instructions before proceeding:

Please read this post completely, it may make it easier for you if you copy and paste this post to a new text document or print it for reference later.

1. Download ComboFix from below:
   Combofix download
   * IMPORTANT !!! Place combofix.exe on your Desktop
   
2. Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with ComboFix.
   You can get help on disabling your protection programs here
   
3. Double click on combofix.exe & follow the prompts.
   
4. As part of it's process, ComboFix will check to see if the Microsoft Windows Recovery Console is installed.
   Please note: If the Microsoft Windows Recovery Console is already installed, ComboFix will continue it's malware removal procedures.
   
   The Windows recovery console will allow you to boot up into a special recovery mode that allows us to help you in the case that your computer has a problem after an attempted removal of malware.
   With malware infections being as they are today, it's strongly recommended to have this pre-installed on your machine before doing any malware removal.
   Follow the prompts to allow ComboFix to download and install the Microsoft Windows Recovery Console, and when prompted, agree to the End-User License Agreement.
   ComboFix will now automatically install the Microsoft Windows Recovery Console onto your computer, which will show up as a new option when booting up your computer. Do not select the Microsoft Windows Recovery Console option when you start your computer unless requested to by a helper.
   Once the Microsoft Windows Recovery Console is installed using ComboFix, you should see a message that says:
   The Recovery Console was successfully installed.
   
   Click on Yes, to continue scanning for malware.
   
5. Your desktop may go blank. This is normal. It will return when ComboFix is done. ComboFix may reboot your machine. This is normal.
   
6. When finished, it shall produce a log for you. Post that log in your next reply
   Note:
   Do not mouseclick combofix's window whilst it's running. That may cause it to stall.
   ---------------------------------------------------------------------------------------------
   
7. Ensure your AntiVirus and AntiSpyware applications are re-enabled.
   ---------------------------------------------------------------------------------------------
   

[nealhines]

I ran ComboFix successfully with malware, firewall, and McAfee off. The log is a bit long, so I have attached it instead of posting it within this message.

Laptop is running allright, although very slow which might be due to both Malware and McAfee running together. Drat.

Again,

Many Thanks,

-Neal

CombofixLOG.txt

[Kenny94]

Hi

Run CFScript

• Close any open browsers.
  
• Open Notepad by click start
  
• Click Run
  
• Type notepad into the box and click enter
  
• Notepad will open
  
• Copy and Paste everything from the Code box into Notepad:
  

KILLALL::

File::
c:\windows\system32\SET112.tmp

Folder::
c:\documents and settings\All Users\Application Data\RegTask
c:\program files\RegTask
C:\_OTM
C:\FOUND.013
C:\FOUND.012
C:\FOUND.011
C:\FOUND.010
C:\FOUND.009
C:\FOUND.008
C:\FOUND.007
C:\FOUND.006
C:\FOUND.005
C:\FOUND.004
C:\FOUND.003
C:\FOUND.002

Save the file to your desktop and name it CFScript.txt

Then drag the CFScript.txt into the ComboFix.exe as shown in the screenshot below.

This will start ComboFix again. It may ask to reboot. Post the contents of Combofix.txt in your next reply.

Note: These instructions and script were created specifically for this user. If you are not this user, do NOT follow these instructions or use this script as it could damage the workings of your system.

[nealhines]

The CFScript ran like you outlined.

Combofix log attached.

ComboFix.txt

[Kenny94]

Smile we are getting closer. Good job you done there...

Please download ATF Cleaner by Atribune.

• Double-click ATF-Cleaner.exe to run the program.
  
• Under Main choose: Select All
  
• Click the Empty Selected button.
  

Click Exit on the Main menu to close the program.

Next

Update Run Malwarebytes

• Launch Malwarebytes' Anti-Malware
  
• If an update is found, it will download and install the latest version.
  
• Once the program has loaded, select "Perform Quick Scan", then click Scan.
  
• The scan may take some time to finish,so please be patient.
  
• When the scan is complete, click OK, then Show Results to view the results.
  
• Make sure that everything is checked, and click Remove Selected.
  
• When disinfection is completed, a log will open in Notepad and you may be prompted to Restart.(See Extra Note)
  
• The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM.
  
• Copy&Paste the entire report in your next reply.
  

Extra Note:

If MBAM encounters a file that is difficult to remove,you will be presented with 1 of 2 prompts,click OK to either and let MBAM proceed with the disinfection process,if asked to restart the computer,please do so immediatly.

[nealhines]

Here is the MBAM quick scan log.

I will perform a full scan, just to be sure.

1/15/2011 10:18:12 AM

mbam-log-2011-01-15 (10-18-12).txt

Scan type: Quick scan

Objects scanned: 143432

Time elapsed: 2 minute(s), 45 second(s)

Memory Processes Infected: 0

Memory Modules Infected: 0

Registry Keys Infected: 0

Registry Values Infected: 0

Registry Data Items Infected: 0

Folders Infected: 0

Files Infected: 0

Memory Processes Infected:

(No malicious items detected)

Memory Modules Infected:

(No malicious items detected)

Registry Keys Infected:

(No malicious items detected)

Registry Values Infected:

(No malicious items detected)

Registry Data Items Infected:

(No malicious items detected)

Folders Infected:

(No malicious items detected)

Files Infected:

(No malicious items detected)

[Kenny94]

Visit here for system improvement: Help! My computer is slow!

Also, be sure you use Secunia software inspector & update checker below "Additional Security Measures"

Your Computer is Clean

Some final items:

Follow these steps to uninstall Combofix and tools used in the removal of malware

• Please press the Windows Key and R on your keyboard. This will bring up the Run... command.
  
• Now type in Combofix /Uninstall in the runbox and click OK. (Notice the space between the x and /)
  
  
• Please follow the prompts to uninstall Combofix.
  
• You will then recieve a message saying Combofix was uninstalled successfully once it's done uninstalling itself.
  

This will uninstall Combofix, delete its related folders and files, reset your clock settings, hide file extensions, hide the system/hidden files and resets System Restore again.

Here are some additional links for you to check out to help you with your computer security.

Browsers

Just because your computer came loaded with Internet Explorer doesn't mean that you have to use it, there are other free alternatives, FIREFOX and OPERA, both are free to use and are more secure than IE.

If you are using firefox you can stay more secure by adding NoScript and WOT (Web Of Trust)

NoScript stops Java scripts from starting on a web page unless you give permission for them, and WOT (Web Of Trust) has a comprehensive list of ratings for different websites allowing you to easily see if a website that you are about to go to has a bad reputation; in fact it will warn you to check if you are sure that you want to continue to a bad website.

• Make your Internet Explorer more secure - This can be done by following these simple instructions:
  
• From within Internet Explorer click on the Tools menu and then click on Options.
  
• Click once on the Security tab
  
• Click once on the Internet icon so it becomes highlighted.
  
• Click once on the Custom Level button.
  
• Change the Download signed ActiveX controls to Prompt
  
• Change the Download unsigned ActiveX controls to Disable
  
• Change the Initialize and script ActiveX controls not marked as safe to Disable
  
• Change the Installation of desktop items to Prompt
  
• Change the Launching programs and files in an IFRAME to Prompt
  
• Change the Navigate sub-frames across different domains to Prompt
  
• When all these settings have been made, click on the OK button
  
• If it prompts you as to whether or not you want to save the settings, press the Yes button.
  
• Next press the Apply button and then the OK to exit the Internet Properties page.
  

Additional Security Measures

Visit Microsoft's Windows Update Site Frequently - It is important that you visit http://www.windowsupdate.com regularly. This will ensure your computer has always the latest security updates available installed on your computer. If there are new updates to install, install them immediately, reboot your computer, and revisit the site until there are no more critical updates.

SpywareBlaster- SpywareBlaster will add a large list of programs and sites into your Internet Explorer settings that will protect you from running and downloading known malicious programs.

A tutorial for Spywareblaster can be found here.

Cookienator- Scans your PC for tracking cookies in multiple browsers as well as in Adobe Flash.

Secunia software inspector & update checker

Visit My Blog for Malware and Spyware Tips

[nealhines]

Thanks for the advice. I removed ComboFix. MBAM, SuperAntispyware, and Comodo all seem to be humming along slashing at crap. You've helped restore my faith in the common good. Many thanks for your hands. I visited your blog and contributed today.

-Neal

[Kenny94]

I would keep Malwarebytes. I do not work for Malwarebytes. I'm a volunteer on their forums. Thank you for your donation Neal!

[Kenny94]

Hi again Neal,

I misread your last replied:

MBAM, SuperAntispyware, and Comodo all seem to be humming along slashing at crap.

Great.....

I said this many times...Why can't these guys do something interesting like Piranha Swimming to get their kicks!

[screen317]

Glad we could help.

If you need this topic reopened, please send a Private Message to any one of the moderating team members. Please include a link to this thread with your request. This applies only to the originator of this thread.

Other members who need assistance please start your own topic in a new thread. Thanks!