Mini Spy

Loading...

Latest Threads

Loading...
 
  1. Before you start!
    All given instructions in this forum are customized for each help request, the tools used may cause damage if used on a computer with different infections. If you think you have similar issues, please post the appropriate logs in our Malware Removal Assistance forum and wait for help.

    Please be aware that removing Malware is a potentially hazardous undertaking. We will take care not to knowingly suggest courses of action that might damage your computer. However it is impossible for us to foresee all interactions that may happen between the software on your computer and those we'll use to clear you of infection, and we cannot guarantee the safety of your system. It is possible that we might encounter situations where the only recourse is to re-format and re-install your operating system, or to necessitate you taking your computer to a repair shop.
    We strongly advise you to backup any personal files and folders before you start.
  2. HitmanPro CHRISTMAS GIVEAWAY: REVO UNINSTALLER PRO GIVEAWAY

    Get a free license key for Revo Uninstaller Pro. We are giving away free Revo Uninstaller Pro keys for our awesome members!

    (LIVE) Get now a Revo Uninstaller Pro license key!

  3. CHRISTMAS GIVEAWAY: SPYSHELTER PREMIUM GIVEAWAY

    Get a free license key for SpyShelter Premium. We are giving away free SpyShelter Premium keys for our awesome members!

    (LIVE) Get now a SpyShelter Premium license key!

Cryptic Trojan Horse

Discussion in 'Malware Removal Assistance' started by paultess, Jan 3, 2013.

Thread Status:
Not open for further replies.
  1. paultess

    paultess Regular Member

    Reputation:
    0
    Joined:
    Jan 3, 2013
    Messages:
    55
    Likes Received:
    0
    I am a learner with this side of computer use - I have never tried to fix anything in Safe Mode for example.
    Any help to fix without re-formatting is appreciated.
     

    Attached Files:

  2. kuttus

    kuttus Active Member

    Reputation:
    0
    Joined:
    Oct 5, 2012
    Messages:
    2,767
    Likes Received:
    80
    Hi and welcome to the MalwareTips.com forums!

    I'm Kuttus and I am going to try to assist you with your problem. Please take note of the below:
    • I will start working on your malware issues, this may or may not, solve other issues you have with your machine.
    • The fixes are specific to your problem and should only be used for this issue on this machine!
    • The process is not instant. Please continue to review my answers until I tell you your machine is clear. Absence of symptoms does not mean that everything is clear.
    • If you don't know, stop and ask! Don't keep going on.
    • Please reply to this thread. Do not start a new topic.
    • Refrain from running self fixes as this will hinder the malware removal process.
    • It may prove beneficial if you print of the following instructions or save them to notepad as I post them.
    Your security programs may give warnings for some of the tools I will ask you to use. Be assured, any links I give are safe.


    Before we start:
    Please be aware that removing malware is a potentially hazardous undertaking. I will take care not to knowingly suggest courses of action that might damage your computer. However it is impossible for me to foresee all interactions that may happen between the software on your computer and those we'll use to clear you of infection, and I cannot guarantee the safety of your system. It is possible that we might encounter situations where the only recourse is to re-format and re-install your operating system, or to necessitate you taking your computer to a repair shop.

    Because of this, I advise you to backup any personal files and folders before you start.
    <hr />

    You should be able to run both scans while in Normal mode...
    STEP 1: Run a scan with Malwarebytes Anti-Malware in Chamelon mode

    <ol>
    <li>Download <>Malwarebytes Chameleon from <a title="External link" href="http://downloads.malwarebytes.org/file/chameleon" rel="nofollow external">here</a> </>and extract it to a folder in a convenient location</li>
    <li>Make certain that your PC is connected to the internet and then open the folder where you extracted Chameleon to and double-click on the Chameleon help file and then follow the onscreen instructions to use it.</li>
    <li>If the Chameleon help file itself will not open, then double-click each file one by one until you find one that works, which will be indicated by a black DOS/command prompt window <em><>Note:</> Do not attempt to open <>mbam-killer</> as that is not a Chameleon executable and serves a different purpose)</em></li>
    <li>Follow the onscreen instructions to press a key to continue and Chameleon will proceed to download and install Malwarebytes Anti-Malware for yo</li>
    <li>Once it has done this, it will attempt to update Malwarebytes Anti-Malware, click <>OK</> when it says that the database was updated successful</li>
    <li>Next, Malwarebytes Anti-Malware will automatically open and perform a Quick scan</li>
    <li>Upon completion of the scan, if anything has been detected, click on <>Show Result</></li>
    <li>Have Malwarebytes Anti-Malware remove any threats that are detected and click <>Yes</> if prompted to reboot your computer to allow the removal process to complete</li>
    <li>After your computer restarts, open <>Malwarebytes Anti-Malware</> and perform a Full System scan to verify that there are no remaining threats</li>
    Please add both logs in your next reply.
    </ol>

    <hr />

    STEP 2 : Run a scan with Kaspersky TDSSKiller
    <ol>
    <li>Download Kaspersky TDSKiller from the below link.
    <><a title="External link" href="http://support.kaspersky.com/downloads/utils/tdsskiller.exe" rel="external">KASPERKSY TDSSKILLER DOWNLOAD LINK</a></> <em>(This link will automatically download Kaspersky TDSSKiller on your computer)</em>
    </li>
    <li>Double-click on <>TDSSKiller.exe</> to run the application.
    <img src="http://img4.imageshack.us/img4/1907/tdss1.png" alt="Posted Image" /></li>
    <li>Click <>Change parameters</>
    <img src="http://img593.imageshack.us/img593/288/tdss2.png" alt="Posted Image" /></li>
    <li>Check the boxes next to <[b]>Verify Driver Digital Signature</[b]> and <[b]>Detect TDLFS file system</[b]>, then click <[b]>OK</[b]>
    <img src="http://img521.imageshack.us/img521/1456/tdss3.png" alt="Posted Image" /></li>
    <li>Click on the <[b]>Start Scan</[b]> button to begin the scan and wait for it to finish.
    <[b]>NOTE:</[b]> Do not use the computer during the scan!</li>
    <li>During the scan it will look similar to the image below:
    <img src="http://img6.imageshack.us/img6/9136/tdss4.jpg" alt="Posted Image" /></li>
    <li>When it finishes, you will either see a report that no threats were found like below:
    <img src="http://img696.imageshack.us/img696/9898/tdss5.jpg" alt="Posted Image" />
    If no threats are found at this point, just click the <[b]>Report</[b]> selection on the top right of the form to generate a log. A log file report will pop which you can just close since the report file is already saved.</li>
    <li>If any infection or suspected items are found, you will see a window similar to below:
    <img src="http://img854.imageshack.us/img854/905/tdss7.jpg" alt="Posted Image" />
    <ul>
    <li>If you have files that are shown to fail <em>signature check</em> do not take any action on these. Make sure you select <[b]>Skip</[b]>. I will tell you what to do with these later. They may not be issues at all.</li>
    <li>If <em>Suspicious objects</em> are detected, the default action will be Skip. Leave the default set to Skip.</li>
    <li>If <em>Malicious objects</em> are detected, they will show in the Scan results. TDSSKiller automatically selects an action (Cure or Delete) for malicious objects
    Make sure that <[b]>Cure</[b]> is selected. <[b]>VERY IMPORTANT!</[b]> - If <em>Cure</em> is not available, please choose <[b]>Skip</[b]> instead. [b]DO NOT[/b] choose Delete unless instructed to do so.</li>
    </ul>
    </li>
    <li>Click <[b]>Continue</[b]> to apply selected actions.</li>
    <li>A reboot may be required to complete disinfection. A window like the below will appear:
    <img src="http://img828.imageshack.us/img828/4812/tdss6.jpg" alt="Posted Image" />
    Reboot immediately if TDSSKiller states that one is needed.</li>
    <li>Whether an infection is found or not, a log file should have already been created on your C: drive (or whatever drive you boot from) in the root folder named something like <[b]>TDSSKiller.2.1.1_2.12.2012_14.17.04_log.txt</[b]> which is based on the program version # and date and time run.</li>
    <li>Attach this log to your next reply.</li>
    </ol>
    <hr />


    Please run the following utility so that I can get a log of your system...
    [SIZE=4]STEP 3 : Run a scan with Combofix[/SIZE]
    [CENTER][color=#FF0000][b]Please read and follow very carefully the below instructions[/b][/color][/CENTER]

    Download [b]ComboFix[/b] from one of the following locations:

    [url=http://download.bleepingcomputer.com/sUBs/ComboFix.exe][b]COMBOFIX DOWNLOAD LINK #1[/b][/url] [i](This link will automatically download Combofix on your computer)[/i]
    [url=http://www.forospyware.com/sUBs/ComboFix.exe][b]COMBOFIX DOWNLOAD LINK #2[/b][/url] [i](This link will automatically download Combofix on your computer)[/i]
    ----------------------------------------------------------------
    [color=red]VERY IMPORTANT !!! [/color]Save ComboFix.exe to your [b]Desktop [/b]

    <ul>
    <li>Close any open browsers.</li>
    <li>Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.
    <[b]>Very Important!</[b]> Temporarily <[b]>disable</[b]> your <[b]>anti-virus</[b]>, <[b]>script blocking</[b]> and any <[b]>anti-malware</[b]> real-time protection <em><[b]>before</[b]></em> performing a scan. They can interfere with ComboFix or remove some of its embedded files which may cause <em>"unpredictable results"</em>.</li>
    <li><[b]>WARNING: Combofix will disconnect your machine from the Internet as soon as it starts</[b]>.Please do not attempt to re-connect your machine back to the Internet until Combofix has completely finished.
    If there is no internet connection after running Combofix, then restart your computer to restore back your connection.</li>
    </ul>
    -----------------------------------------------------------------

    [u][b]How to run the Combofix scan : [/b][/u]
    [list=1][*]Double click on [b]ComboFix.exe[/b] & follow the prompts.
    [*]Accept the disclaimer and allow to update if it asks
    [*]When finished, it shall produce a log for you.[b]
    [*]Please include the C:\ComboFix.txt in your next reply.[/b]
    [/list]

    [b][color=red]Additional notes:
    <ol><li> Do not mouse-click Combofix's window while it is running. That may cause it to stall.</li>
    <li> Do not "re-run" Combofix. If you have a problem, reply back for further instructions.</li>
    <li> If after the reboot you get errors about programms being marked for deletion then reboot, that will cure it.</li></ol>

    [/color][/b]

    <hr />

    [SIZE=4][b]What's next?[/b]

    Add the following logs to your next post (You can find [url=http://malwaretips.com/Thread-How-to-use-the-attachment-system?pid=16072#pid16072][b]here[/b][/url] details on how to use the Attachment System):
    1. Malwarebytes Log
    2. Combofix log
    3. Kaspersky TDSSKiller Log
    4. Let me know if you had any problems with the above instructions and also <[b]>let me know how things are running now!</[b]>[/b][/b][/SIZE][b][b]

    <hr />[/b][/b][/b][/b][/b][/b][/b][/b][/b][/b][/b][/b][/b][/b][/b][/b][/b][/b][/b][/b][/b][/b][/b][/b][/b][/b][/b][/b][/b][/b][/b][/b][/b][/b][/b][/b][/b][/b][/b][/b]
     
    Last edited by a moderator: Mar 13, 2014
  3. paultess

    paultess Regular Member

    Reputation:
    0
    Joined:
    Jan 3, 2013
    Messages:
    55
    Likes Received:
    0
    Please accept my apologies for not replying before. I read through your instructions and decided it is way over my pay-grade. I intended to let you know quickly but work piled up and replying totally slipped my mind. I appreciated your reply and the time you spent to respond but didn't feel comfortable attempting to implement the process.
    The problem of course persists and I re-read your instructions and decided to attempt to follow them. They are very clear but somewhat daunting.
    I will start tomorrow...Thursday...and keep you informed.
     
  4. kuttus

    kuttus Active Member

    Reputation:
    0
    Joined:
    Oct 5, 2012
    Messages:
    2,767
    Likes Received:
    80
    Welcome back to MT,

    No issues. Take your time and let us know... Post the log files after you try the above steps.... :)
     
  5. paultess

    paultess Regular Member

    Reputation:
    0
    Joined:
    Jan 3, 2013
    Messages:
    55
    Likes Received:
    0
    Both scans run with malaware with no threats detected. Same problems exist.
    paul
     

    Attached Files:

  6. kuttus

    kuttus Active Member

    Reputation:
    0
    Joined:
    Oct 5, 2012
    Messages:
    2,767
    Likes Received:
    80
    STEP 1: Run a HitmanPro scan
    <ol>
    <li><>Download the latest official version of HitmanPro</>.
    <a href="http://www.surfright.nl/en/hitmanpro/" rel="nofollow" target="_blank"> <>HITMANPRO DOWNLOAD LINK</></a> <em>(This link will open a download page in a new window from where you can download HitmanPro)</em></li>
    <li>Start HitmanPro by <>double clicking on the previously downloaded file.</> and then following the prompts.
    <img src="http://malwaretips.com/images/removalguide/hpro4.png" alt="[Image: hitmanproscan4.png]" border="0" /></li>
    <li>Once the scan is complete, a screen displaying all the malicious files that the program found will be shown as seen in the image below.After reviewing each malicious object click <>Next</> .
    <img src="http://malwaretips.com/blogs/wp-content/uploads/2012/02/rsz_hpro5.png" alt="[Image: hitmanproscan5.png]" border="0" /></li>
    <li>Click <>Activate free license</> to start the free 30 days trial and remove the malicious files.
    <img src="http://malwaretips.com/images/removalguide/hpro6.png" alt="[Image: hitmanproscan6.png]" border="0" /></li>
    <li>HitmanPro will now start removing the infected objects, and in some instances, may suggest a reboot in order to completely remove the malware from your system. In this scenario, always confirm the reboot action to be on the safe side.
    </ol>
    Add to your next reply, any log that HitmanPro might generate.
    <hr />

    STEP 2: Run a scan with OTL by OldTimer
    <ol><li>Download the OTL utility using the below link :
    <><a title="External link" href="http://oldtimer.geekstogo.com/OTL.exe" rel="nofollow external">OTL DOWNLOAD LINK</a> <em>(This link will automatically download OTL on your computer)</em></></li>
    <li>Double click on the icon to run it. Make sure all other windows are closed and to let it run uninterrupted.
    <img src="http://malwaretips.com/blogs/wp-content/uploads/2012/07/OTL-logo.png" alt="" title="OTL-logo" width="106" height="118" class="alignnone size-full wp-image-3946" /></li>
    <li>When the window appears, <>underneath Output</> at the top change it to <>Minimal Output</>.</li>
    <li>Check the boxes beside <>LOP Check</> and <>Purity Check</>.</li>
    <li>Click the<[b]> Run Scan</[b]> button.
    <img src="http://malwaretips.com/blogs/wp-content/uploads/2012/07/OTL.png" alt="" title="OTL" width="658" height="584" class="alignnone size-full wp-image-3945" /></li>
    <li>When the scan completes, it will open two notepad windows. <[b]>OTL.Txt</[b]> and <[b]>Extras.Txt</[b]>. These are saved in the same location as OTL.
    <[b]>Please post this 2 logs in your first reply.</[b]>.</li></ol>

    [i][u]Settings You need to Select in OTL[/u]
    [list=1]
    [*] Click the [b]Scan All Users[/b] checkbox.
    [*] Change [b]Standard Registry[/b] to [b]All[/b].
    [*] Check the boxes beside [b]LOP Check[/b] and [b]Purity Check.[/b]
    [/list][/i]
    <em>Note: If OTL.exe will not run, it may be blocked by malware. Try these alternate versions: <a title="External link" href="http://www.itxassociates.com/OT-Tools/OTL.scr" rel="nofollow external">OTL.scr</a>, or <a title="External link" href="http://oldtimer.geekstogo.com/OTL.com" rel="nofollow external">OTL.com</a>.</em>

    <hr />[/b][/b][/b][/b][/b][/b][/b][/b]
     
    Last edited by a moderator: Mar 13, 2014
  7. paultess

    paultess Regular Member

    Reputation:
    0
    Joined:
    Jan 3, 2013
    Messages:
    55
    Likes Received:
    0
    Re. Combofix. I ran but it did not complete. 3 messages:
    1. Freeware implementation of XCACLS has stopped working
    2. Update summary SpeedMaxPC -Not a program on my PC
    3. Unable to update product because of missing components.

    I stopped at that point. HitManPro not run.
    The 4 TDSS files generated are attached.
     

    Attached Files:

  8. kuttus

    kuttus Active Member

    Reputation:
    0
    Joined:
    Oct 5, 2012
    Messages:
    2,767
    Likes Received:
    80
    No need to run the Combofix now... Please delete the Combofix.exe file from your computer ASAP...

    Run the TDSS Killer once again and it will detect one infection \Device\Harddisk0\DR0 select that one and make the action as Cure and press on Continue.. After that update me the new LogFiles...
     
  9. paultess

    paultess Regular Member

    Reputation:
    0
    Joined:
    Jan 3, 2013
    Messages:
    55
    Likes Received:
    0
    Cure is not an option:
    Skip
    Quarantine
    Delete
     
  10. kuttus

    kuttus Active Member

    Reputation:
    0
    Joined:
    Oct 5, 2012
    Messages:
    2,767
    Likes Received:
    80
    STEP 1: Run a scan with aswMBR:
    1. Download aswmbr.exe from the below link:
      aswMBR DOWNLOAD LINK <em>(This link will automatically download aswMBR on your computer)</em>
    2. Double click the aswMBR.exe to run it.
    3. Click the [Scan] button to start scan
      [​IMG]

    4. On completion of the scan click [Save log], save it to your desktop and post in your next reply.
      [​IMG]
    <hr />
     
  11. paultess

    paultess Regular Member

    Reputation:
    0
    Joined:
    Jan 3, 2013
    Messages:
    55
    Likes Received:
    0
    For the Kaspersky scan which is still on screen should I skip:
    the infection \Device\Harddisk0\DR0 ;
    Delete it or
    Quarantine it before running aswMBR?

    (I have not yet run OTL by OldTimer or HitMan)
     
  12. paultess

    paultess Regular Member

    Reputation:
    0
    Joined:
    Jan 3, 2013
    Messages:
    55
    Likes Received:
    0
    For the one infection \Device\Harddisk0\DR0 from Kasperky that is still on the screen:
    shall I delete it; quarantine it or skip it before closing.

    (I have not run HitMan or OTL by OldTimer)
     
  13. kuttus

    kuttus Active Member

    Reputation:
    0
    Joined:
    Oct 5, 2012
    Messages:
    2,767
    Likes Received:
    80
    For the time being Skip it.... Then run the aswMBR...
     
  14. paultess

    paultess Regular Member

    Reputation:
    0
    Joined:
    Jan 3, 2013
    Messages:
    55
    Likes Received:
    0
    Completed.
     

    Attached Files:

  15. kuttus

    kuttus Active Member

    Reputation:
    0
    Joined:
    Oct 5, 2012
    Messages:
    2,767
    Likes Received:
    80
    Okay. Run the aswMBR once again and this time instead of Scan press on FixMBR. and restart the computer..... After that Run the TdSSKiller once again and update me the new TdSSKiller log files....
     
  16. paultess

    paultess Regular Member

    Reputation:
    0
    Joined:
    Jan 3, 2013
    Messages:
    55
    Likes Received:
    0
    Completed
    Restarted
    TdSSKiller run

    For the one medium risk:
    TDSS File System Physical drive: \Device\Harddisk0/DR0 that is still on the screen:

    shall I delete it; quarantine it or skip it before closing and sending log?
     
  17. kuttus

    kuttus Active Member

    Reputation:
    0
    Joined:
    Oct 5, 2012
    Messages:
    2,767
    Likes Received:
    80
    quarantine it...
     
  18. paultess

    paultess Regular Member

    Reputation:
    0
    Joined:
    Jan 3, 2013
    Messages:
    55
    Likes Received:
    0
    I cant find a way to save the report to send to you. Ran and quarantined 2 threats.
     
  19. kuttus

    kuttus Active Member

    Reputation:
    0
    Joined:
    Oct 5, 2012
    Messages:
    2,767
    Likes Received:
    80
    Please restart the computer now and run the TDSSKiller once again.
     
  20. paultess

    paultess Regular Member

    Reputation:
    0
    Joined:
    Jan 3, 2013
    Messages:
    55
    Likes Received:
    0
    OK. Restarted, TDSSkiller ran again.
    8 threats, 2 objects quarantined.
    Still cant see a way to send you the log.
     

Want to reply to this thread or ask your own question?

It takes just 2 minutes to sign up (and it's free!). Just click the sign up button to choose a username and then you can ask your own questions on the forum.
Loading...
Thread Status:
Not open for further replies.
MalwareTips.com is an independent website.All trademarks mentioned on this page are the property of their respective owners.