Win 7 Defender removal problem

[asdfdav]

Hi,

Many thanks for posting the guide - sadly I had a go myself before finding this.

Here's what has happened:

After being infected I did a quick look online what to do, and someone proposed to delete the c:/programData folder that seems to contain the malware. I did that, and was then able to do a restore to a date when I know my system was not infected. After this - no problem at all, no pop ups or anything like that. However, the folder programdata is still there, and I am unable to delete it. Also, when trying to re-enable the original Windows Defender anti-malware in Windows, something keeps dis-abeling it. This led me to think that there's something still wrong here...

I browsed again and found this site's walkthrough, followed it step by step. However, neither registryfix (i got an error message when running it), Rkill, Malwarebytes (or spybot SD for that reason) or Hitman pro found anything wrong with my computer, after doing the full scans.

Rogue-killer did find some problems in the registry, which it did correct, but after doing these steps it seems i am back at square one.

Ideas anyone? Much appreciated.

Cheers,
David

 

[Fiery]

Hi there and welcome to MT.

My name is Fiery and I will assist you with the removal of this malware.

Open OTL. Under custom scan/fixes, copy and paste the following:

:OTL
O3:64bit: - HKLM\..\Toolbar: (no name) - Locked - No CLSID value found.
O3 - HKLM\..\Toolbar: (no name) - Locked - No CLSID value found.
O9:64bit: - Extra 'Tools' menuitem : Send by Bluetooth to - {7815BE26-237D-41A8-A98F-F7BD75F71086} - Reg Error: Value error. File not found
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{B758B2D2-EE64-425B-BD7E-4E48E3B79101}: DhcpNameServer = 8.8.8.8 8.8.4.4

:Files
ipconfig /flushdns /c

:Commands
[EMPTYTEMP]
[RESETHOSTS]

Then click Run Fix. Post the log afterwards.

-----------
Step 2: Please download Combofix from here

* make sure you disable ALL of your Antivirus/Antispyware/Firewall before running ComboFix.

* Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools

* Double click on ComboFix.exe & follow the prompts.

* As part of it's process, ComboFix will check to see if the Microsoft Windows Recovery Console is installed. With malware infections being as they are today, it's strongly recommended to have this pre-installed on your machine before doing any malware removal. It will allow you to boot up into a special recovery/repair mode that will allow us to more easily help you should your computer have a problem after an attempted removal of malware.

* Follow the prompts to allow ComboFix to download and install the Microsoft Windows Recovery Console, and when prompted, agree to the End-User License Agreement to install the Microsoft Windows Recovery Console.

**Please note: If the Microsoft Windows Recovery Console is already installed, ComboFix will continue it's malware removal procedures.

Once the Microsoft Windows Recovery Console is installed using ComboFix, you should see the following message:

Click on Yes, to continue scanning for malware.

When finished, it shall produce a log for you. Please include the C:\ComboFix.txt in your next reply.

 

[asdfdav]

Hi there and welcome to MT.

My name is Fiery and I will assist you with the removal of this malware.

Open OTL. Under custom scan/fixes, copy and paste the following:

:OTL
O3:64bit: - HKLM\..\Toolbar: (no name) - Locked - No CLSID value found.
O3 - HKLM\..\Toolbar: (no name) - Locked - No CLSID value found.
O9:64bit: - Extra 'Tools' menuitem : Send by Bluetooth to - {7815BE26-237D-41A8-A98F-F7BD75F71086} - Reg Error: Value error. File not found
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{B758B2D2-EE64-425B-BD7E-4E48E3B79101}: DhcpNameServer = 8.8.8.8 8.8.4.4

:Files
ipconfig /flushdns /c

:Commands
[EMPTYTEMP]
[RESETHOSTS]

Then click Run Fix. Post the log afterwards.

-----------
Step 2: Please download Combofix from here

* make sure you disable ALL of your Antivirus/Antispyware/Firewall before running ComboFix.

* Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools

* Double click on ComboFix.exe & follow the prompts.

* As part of it's process, ComboFix will check to see if the Microsoft Windows Recovery Console is installed. With malware infections being as they are today, it's strongly recommended to have this pre-installed on your machine before doing any malware removal. It will allow you to boot up into a special recovery/repair mode that will allow us to more easily help you should your computer have a problem after an attempted removal of malware.

* Follow the prompts to allow ComboFix to download and install the Microsoft Windows Recovery Console, and when prompted, agree to the End-User License Agreement to install the Microsoft Windows Recovery Console.

**Please note: If the Microsoft Windows Recovery Console is already installed, ComboFix will continue it's malware removal procedures.

Once the Microsoft Windows Recovery Console is installed using ComboFix, you should see the following message:

Click on Yes, to continue scanning for malware.

When finished, it shall produce a log for you. Please include the C:\ComboFix.txt in your next reply.

Hi,

Many thanks for the instructions. I followed otl without any problems, but the combofix was a bit problematic. The first step was fine, but after the automated reboot combofix, I seem to have run into a problem. The combofix windows flickered all over the screen. I kept it running for a good half hour, without any changes ,but eventually tried a reboot,which did not help, still flickering over the screen. Is this normal, or do you have any advise?

Many thanks
David

 

[Fiery]

Hi,

That's very unusual. Can you boot into safe mode and get me the OTL and combofix logs so I know what combofix did. (If you don't know how to boot to safe mode, http://windows.microsoft.com/en-CA/windows-vista/Start-your-computer-in-safe-mode)

 

[asdfdav]

Hi,

That's very unusual. Can you boot into safe mode and get me the OTL and combofix logs so I know what combofix did. (If you don't know how to boot to safe mode, http://windows.microsoft.com/en-CA/windows-vista/Start-your-computer-in-safe-mode)

Thanks, will do. Is it easy to recover the combofix log, even if it did not finish correctly?

 

[Fiery]

There may be a semi-incomplete log. It is usually just in C:\ComboFix.txt

 

[asdfdav]

There may be a semi-incomplete log. It is usually just in C:\ComboFix.txt

Thank you,

No log in the c:/ directory I am afraid, but there was one file in the combofix directory which I have attached. However, this seems not to be a proper log file.

For some reason, the forum did not allow me to upload the otl log, but here is the information from the log:

All processes killed
========== OTL ==========
64bit-Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Toolbar\\Locked deleted successfully.
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Toolbar\\Locked deleted successfully.
64bit-Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Extensions\{7815BE26-237D-41A8-A98F-F7BD75F71086}\ deleted successfully.
64bit-Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{7815BE26-237D-41A8-A98F-F7BD75F71086}\ not found.
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{B758B2D2-EE64-425B-BD7E-4E48E3B79101}\\DhcpNameServer| /E : value set successfully!
========== FILES ==========
< ipconfig /flushdns /c >
IP-konfiguration f”r Windows
DNS-matcharens cacheminne har rensats.
C:\Users\David\Downloads\cmd.bat deleted successfully.
C:\Users\David\Downloads\cmd.txt deleted successfully.
========== COMMANDS ==========

[EMPTYTEMP]

User: All Users

User: David
->Temp folder emptied: 41798681 bytes
->Temporary Internet Files folder emptied: 168165 bytes
->Java cache emptied: 34792 bytes
->Google Chrome cache emptied: 27360348 bytes
->Flash cache emptied: 534 bytes

User: Davidacer
->Temp folder emptied: 9250679 bytes
->Temporary Internet Files folder emptied: 164376 bytes
->Java cache emptied: 0 bytes
->Google Chrome cache emptied: 7290189 bytes
->Flash cache emptied: 743 bytes

User: Default
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 33170 bytes

User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes

User: Public

%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
%systemroot%\System32 (64bit) .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 31170 bytes
%systemroot%\sysnative\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files folder emptied: 85042 bytes
RecycleBin emptied: 0 bytes

Total Files Cleaned = 82,00 mb

C:\Windows\System32\drivers\etc\Hosts moved successfully.
HOSTS file reset successfully

OTL by OldTimer - Version 3.2.69.0 log created on 12272012_205206

Files\Folders moved on Reboot...
File move failed. C:\Users\David\AppData\Local\Temp\FXSAPIDebugLogFile.txt scheduled to be moved on reboot.

PendingFileRenameOperations files...

Registry entries deleted on Reboot...

Can you please advise any further action I should take?

Many thanks,
David

 

[Fiery]

Ok, let's try a different tool.

Download Farbar Recovery Scan Tool from the below link:
<ul><li>For x64 bit systems download <a title="External link" href="http://download.bleepingcomputer.com/farbar/FRST64.exe" rel="nofollow external"><>Farbar Recovery Scan Tool x64</></a> and save it to a flash drive.</li>

<li>Plug the flashdrive into the infected PC.</li>

<li>Enter <>System Recovery Options</>.</li>

<>To enter System Recovery Options from the Advanced Boot Options:</>
<ul>
<li>Restart the computer.</li>
<li>As soon as the BIOS is loaded begin tapping the<> F8</> key until Advanced Boot Options appears.</li>
<li>Use the arrow keys to select the <>Repair your computer</> menu item.</li>
<li>Select <>US</> as the keyboard language settings, and then click <>Next</>.</li>
<li>Select the operating system you want to repair, and then click <>Next</>.</li>
<li>Select your user account an click <>Next</>.</li>
</ul>
<>To enter System Recovery Options by using Windows installation disc:</>
<ul>
<li>Insert the installation disc.</li>
<li>Restart your computer.</li>
<li>If prompted, press any key to start Windows from the installation disc. If your computer is not configured to start from a CD or DVD, check your BIOS settings.</li>
<li>Click <>Repair your computer</>.</li>
<li>Select <>US</> as the keyboard language settings, and then click <>Next</>.</li>
<li>Select the operating system you want to repair, and then click <>Next</>.</li>
<li>Select your user account and click <>Next</>.</li>
</ul>
<li>On the System Recovery Options menu you will get the following options:</span>
<pre>Startup Repair
System Restore
Windows Complete PC Restore
Windows Memory Diagnostic Tool
Command Prompt</pre>
<ol>
<li>Select <>Command Prompt</></li>
<li>In the command window type in <>notepad</> and press <>Enter</>.</li>
<li>The notepad opens. Under File menu select <>Open</>.</li>
<li>Select "Computer" and find your flash drive letter and close the notepad.</li>
<li>In the command window type <><span style="color: #ff0000;">e</span>:\frst.exe</> (for x64 bit version type <><span style="color: #ff0000;">e</span>:\frst64</>) and press <>Enter</>
<>Note:</><span style="color: #ff0000;"> Replace letter <>e</> with the drive letter of your flash drive.</span></li>
<li>The tool will start to run.</li>
<li>When the tool opens click <>Yes</> to disclaimer.</li>
<li>Press <>Scan</> button.</li>
<li><>FRST</> will let you know when the scan is complete and has written the <>FRST.txt</> to file, close out this message, then type the following into the search box:
<>services.exe</></li>
<li>Now press the <>Search</> button</li>
<li>When the search is complete, search.txt will also be written to your USB</li>
<li>Type <>exit</> and reboot the computer normally</li>
<li>Please copy and paste both logs in your reply.(FRST.txt and Search.txt)</li></li>
</ol>
</ul>

 

[asdfdav]

Hi,

It seems I am running into further problems. I I downloaded the software, put it on a memory stick, rebooted on to the f8 menu, and all ok util the system recovery options menu. For some reason it only give me two choices: startup repair or recovery management. No sign of the command prompt. To make things worse, I do not have a windows cd, as the computer does not have a dvd slot, and only came with win7 pre installed. Any thoughts?

 

[Fiery]

Hi,

What version of windows is this? You say you have window 7 Pro but the logs show this is a Windows Vista machine.

Can you do a new OTL scan(normal or safe mode)? and is combofix window still flickering when you start?

 

[asdfdav]

Hi,

Well, it is indeed Windows 7 pro, and the only reason I think this might show differently is as this computer was bought in Germany, everything in the OS was in German, I used a patch to change the language to Swedish (which is my nationality). Could that be a reason why?

Combofix is still flickering if I run my machine w/o safe mode.

Please see attached new OTL log file from my latest scan. (in safe mode)

Many thanks,
David

 

[Fiery]

Hi,

Open OTL. Under custom scan/fixes, copy and paste the following:

:OTL
O4:64bit: - HKLM..\Run: [combofix] C:\ComboFix\CF28249.3XE (Microsoft Corporation)
O4:64bit: - HKLM..\RunOnce: [combofix] C:\ComboFix\CF28249.3XE (Microsoft Corporation)

Then click Run Fix. That should stop Combofix from flickering now.

Download a new copy of combofix and try to run it in safe mode.

 

[asdfdav]

Hi,

Open OTL. Under custom scan/fixes, copy and paste the following:

:OTL
O4:64bit: - HKLM..\Run: [combofix] C:\ComboFix\CF28249.3XE (Microsoft Corporation)
O4:64bit: - HKLM..\RunOnce: [combofix] C:\ComboFix\CF28249.3XE (Microsoft Corporation)

Then click Run Fix. That should stop Combofix from flickering now.

Download a new copy of combofix and try to run it in safe mode.

Hi,
It seems only one of the fixes entered in otl worked, as I got a message after saying error on the second line.

Combofix ran without problem pre reboot as before, and after reboot the flickering was back.

Any advise on these happenings?

Many thanks,
David

 

[Fiery]

Hi David, when you tried to get to command prompt following the FRST instruction, you said there's recovery management. Did you click it to see what's in Recovery Management? Let me know.

Also, let's try this.

• Double click on OTL.exe to run it.
• Click the Scan All Users checkbox.
• Change Standard Registry to All
• Check the boxes beside LOP Check and Purity Check
• Under custom scan/fixes, copy & paste the following
  
  

  netsvcs
  msconfig
  safebootminimal
  safebootnetwork
  activex
  drivers32
  DRIVES
  CREATERESTOREPOINT
  %SYSTEMDRIVE%\*.*
  %USERPROFILE%\*.*
  %USERPROFILE%\Application Data\*.*
  %USERPROFILE%\Application Data\*.
  %USERPROFILE%\Local Settings\*.*
  %USERPROFILE%\Local Settings\temp\*.exe
  %USERPROFILE%\Local Settings\Temporary Internet Files\*.exe
  %USERPROFILE%\Local Settings\Application Data\*.*
  %AllUsersProfile%\*.*
  %AllUsersProfile%\Application Data\*.*
  %AllUsersProfile%\Application Data\*.
  %AllUsersProfile%\Application Data\Local Settings\*.*
  %AllUsersProfile%\Application Data\Local Settings\Temp\*.exe
  %ALLUSERSPROFILE%\Documents\My Music\*.exe
  %ALLUSERSPROFILE%\Documents\My Pictures\*.exe
  %ALLUSERSPROFILE%\Documents\My Videos\*.exe
  %ALLUSERSPROFILE%\Documents\*.exe
  %USERPROFILE%\My Documents\*.*
  %CommonProgramFiles%\*.*
  %CommonProgramFiles%\ComObjects*.*
  %PROGRAMFILES%\*.*
  %PROGRAMFILES%\*.
  %systemroot%\system32\config\systemprofile\*.*
  %systemroot%\system32\config\systemprofile\Application Data\*.*
  %systemroot%\system32\config\systemprofile\\Local Settings\*.*
  %systemroot%\system32\config\systemprofile\\Local Settings\Application Data\*.*
  %systemroot%\system32\config\systemprofile\\Local Settings\Temp\*.exe
  %systemroot%\system32\config\systemprofile\\Local Settings\Temporary Internet Files\*.exe
  C:\Documents and Settings\LocalService\Application Data\*.*
  C:\Documents and Settings\LocalService\Local Settings\Application Data\*.*
  C:\Documents and Settings\LocalService\Local Settings\temp\*.exe
  C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\*.exe
  C:\Documents and Settings\LocalService\Local Settings\*.*
  C:\Documents and Settings\LocalService\*.*
  C:\Documents and Settings\NetworkService\Application Data\*.*
  C:\Documents and Settings\NetworkService\Local Settings\Application Data\*.*
  C:\Documents and Settings\NetworkService\Local Settings\temp\*.exe
  C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\*.exe
  C:\Documents and Settings\NetworkService\Local Settings\*.*
  C:\Documents and Settings\NetworkService\*.*
  %windir%\temp\*.exe
  %windir%\*.
  %windir%\installer\*.
  %windir%\system32\*.
  %Temp%\smtmp\1\*.*
  %Temp%\smtmp\2\*.*
  %Temp%\smtmp\3\*.*
  %Temp%\smtmp\4\*.*
  %systemroot%\system32\*.dll /lockedfiles
  %systemroot%\Tasks\*.job /lockedfiles
  %systemroot%\system32\drivers\*.sys /90
  %systemroot%\system32\drivers\*.sys /lockedfiles
  %systemroot%\system32\Spool\prtprocs\w32x86\*.dll
  %systemroot%\*. /rp /s
  %systemroot%\assembly\tmp\*.* /S /MD5
  %systemroot%\assembly\temp\*.* /S /MD5
  %systemroot%\assembly\GAC\*.ini
  %systemroot%\assembly\GAC_32\*.ini
  %SystemRoot%\assembly\GAC_MSIL\*.ini
  wsSystemRoot|l,n,u,@;True;False;True;$,{ /fn
  %systemdrive%\$Recycle.Bin|@;true;true;true /fp
  HKEY_CLASSES_ROOT\CLSID\{7C857801-7381-11CF-884D-00AA004B2E24} /s
  HKEY_CLASSES_ROOT\CLSID\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1} /s
  HKEY_CURRENT_USER\Software\Classes\CLSID\{42aedc87-2188-41fd-b9a3-0c966feabec1} /s
  HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1} /s
  HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{42aedc87-2188-41fd-b9a3-0c966feabec1} /s
  HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{a2a9545d-a0c2-42b4-9708-a0b2badd77c8} /s
  HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{7C857801-7381-11CF-884D-00AA004B2E24} /s
  HKEY_CLASSES_ROOT\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F} /s
  HKEY_CLASSES_ROOT\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9} /s
  HKEY_CURRENT_USER\Software\Classes\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9} /s
  HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{5839FCA9-774D-42A1-ACDA-D6A79037F57F} /s
  HKEY_CURRENT_USER\Software\Classes\clsid\{12d0253a-7c96-815c-11e0-3034bbd97cc0}] /s
  HKEY_CURRENT_USER\Software\MSOLoad /s
  /md5start
  eventlog.dll
  scecli.dll
  netlogon.dll
  cngaudit.dll
  sceclt.dll
  ntelogon.dll
  logevent.dll
  consrv.dll
  services.exe
  svchost.exe
  explorer.exe
  userinit.exe
  winlogon.exe
  smss.exe
  lsass.exe
  atapi.sys
  iaStor.sys
  serial.sys
  disk.sys
  volsnap.sys
  redbook.sys
  i8042prt.sys
  afd.sys
  netbt.sys
  tcpip.sys
  ipsec.sys
  hlp.dat
  str.sys
  crexv.ocx
  asr_nsta.dll
  /md5stop

• Click on Run Scan at the top left hand corner.
• When done, two Notepad files will open.
  • OTListIt.txt <-- Will be opened
  • Extra.txt <-- Will be minimized
• Please post the contents of these 2 Notepad files in your next reply.

 

[asdfdav]

Hi Fiery,

Again, thanks for taking the time to help.

I ran the OTL scan as per your instructions, but just ended up with one log file - called OTL.txt (attached), could I have done something wrong?

Regarding the recovery management - I had three choices, which were presented in German, rather than Swedish which I have in most of all the other parts of the OS - here's the translations, straight out of google translate, so apologies for the bad English:

1. Factory settings for system restore completely - they are the factory settings for the pc restore. all data on the drive C: will be deleted.

2. Operating system to restore and maintain user data - they provide only for the operating system on your pc restore the factory settings. files from user accounts are transferred to c :/ backup. This option does not remove any existing viruses or other malicious programs.

3. Cancel

Any thoughts on that?

Thanks,
David

 

[Fiery]

Hi David,

Since your logs show a different operating system(Window vista, window 7 home premium, window 7 Pro) and you don't have half the system recovery tools as a normal operating system does, this *may* not be a genuine copy of windows. May I know what brand is your computer?

Let's try this.

Please print these instruction out so that you know what you are doing

• Download OTLPENet.exe to your desktop
• Download Farbar Recovery Scan Tool and save it to a flash drive.
• Download List Parts and save it to the flash drive also.
• Ensure that you have a blank CD in the drive
• Double click OTLPENet.exe and this will then open imgburn to burn the file to CD
• Reboot your system using the boot CD you just created.
  Note : If you do not know how to set your computer to boot from CD follow the steps here
• Wait for the CD to detect your hardware and load the operating system
• Your system should now display a Reatogo desktop
  Note : as you are running from CD it is not exactly speedy
• Insert the USB with FRST
• Locate the flash drive with FRST and double click
• The tool will start to run.
• When the tool opens click Yes to disclaimer.
• Press Scan button.
• It will make a log (FRST.txt) on the flash drive. Please copy and paste it to your reply.
• Next click List Parts and then click Scan
  It will make a log Results.txt on the flash drive. Please copy and paste it to your reply.

 

[asdfdav]

Good morning,

It should be a genuine copy as I bought the computer from a retailer, and like I said, the only thing I have modified is the language. The computer is an Acer timelinex 3820 TG. This computer does not have a dvd drive, so I am not sure if the steps you mention above are possible?

Many thanks,
David

 

[Fiery]

Hi David,

Try burning OTLPE into a USB using instructions here: http://forums.majorgeeks.com/showthread.php?t=216844

 

[asdfdav]

Thank you, will do, just have to shop a larger flash drive than the one I have now. Hopefully I can find some place open today.

 

[asdfdav]

Hi again,

I have followed the steps from the link above, but stumbled on the last step I am afraid. I run the usb_prep8, and enter all the information. But even though I have plugged in the removable usb (in several ports to try), I am unable to choose the usb in the drop-down menu. I press refresh but nothing updates. I can however see the usb drive in 'my computer', so it does work.

Do we have any way of moving forward from this? Or do you need any further details?

Many thanks,
David